Said It Here

Why is it so hard to manage short-lived server certificates?

Short-lived SSL certificates force administrators to manually update keys across dozens of servers every few months. This overwhelming administrative overhead makes routine maintenance unsustainable and leaves systems at risk of frequent disruptions.

What people tried

Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.

  1. 1
    Manually updating certificates on every single machine
  2. 2
    Deploying an internal Certificate Authority with auto-enrollment
  3. 3
    Buying commercial wildcard certificates with longer validity
  4. 4
    Using PowerShell modules and ACME clients like POSH ACME or win-acme to automate certificate creation and management.
  5. 5
    Treating the 47-day cycle like a recurring ops task with a calendar reminder and documented runbook
  6. 6
    Migrating applications to alternative solutions like Cloudflare Zero Trust

In their words

Unedited, most upvoted first, each linked to the thread it came from.

“Our primary use is IIS/Radius and the admin overhead for the mandatory < 1-year certs on these 30+ servers has gotten way too high.”source ↗

techtornado · r/sysadmin · 7 upvotes

“To my knowledge, there is currently no automated way to do a certificate rotation -- would love to be proven wrong.”source ↗

FatBook-Air · r/sysadmin · 6 upvotes

“In the past I just updated all the DC’s, but now with certs only lasting 199 days…. And eventually like 40 days…. I’d rather not update my original DCs as they last 1 year.”source ↗

Real-Patriot-1128 · r/sysadmin · 1 upvotes

“We're still rotating Entra Application Proxy certificates on a calendar because there is no clean ACME path into the custom-domain binding.”source ↗

accumentum · r/sysadmin · 1 upvotes

Where this came up

r/sysadminautomationit managementserver administrationsysadmin

People with this problem also raised