Why is it so hard to manage short-lived server certificates?
Short-lived SSL certificates force administrators to manually update keys across dozens of servers every few months. This overwhelming administrative overhead makes routine maintenance unsustainable and leaves systems at risk of frequent disruptions.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Manually updating certificates on every single machineDid this help you?
- 2Deploying an internal Certificate Authority with auto-enrollmentDid this help you?
- 3Buying commercial wildcard certificates with longer validityDid this help you?
- 4Using PowerShell modules and ACME clients like POSH ACME or win-acme to automate certificate creation and management.Did this help you?
- 5Treating the 47-day cycle like a recurring ops task with a calendar reminder and documented runbookDid this help you?
- 6Migrating applications to alternative solutions like Cloudflare Zero TrustDid this help you?
- 7Renewing certificates 10-20 days ahead of time manually for convenienceDid this help you?
- 8Migrating everything to Let's Encrypt / ACME renewalsDid this help you?
- 9Using automated tools and reverse tunneling where applicableDid this help you?
- 10Relying on internal CAs for private web servers to avoid limitsDid this help you?
- 11Buying a new certificate from another vendor or deploying Let's Encrypt so the old certificate remains valid until expiry.Did this help you?
- 12Using Ansible playbooks to distribute and rotate SSH keys across serversDid this help you?
- 13Running internal Certificate Authorities using tools like HashiCorp Vault or step-ca with ACME protocolDid this help you?
- 14Deploying Let's Encrypt / ACME with DNS-01 verification to automate renewals without exposing HTTP ports to the internetDid this help you?
- 15Tracking certificate expiration manually using Excel spreadsheets and Outlook calendar eventsDid this help you?
- 16Writing homegrown scripts and custom Docker containers to automate certificate distributionDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“I'm looking to reduce a yearly work-load item to update SSH keys and with the newer shorter SSL Certificates that are coming, I want to implement an automated system to manage these centrally.”source ↗
“Just looking for pointers as to what systems you use to manage either/both SSH keys and SSL Certificates in an automated way?”source ↗
“What's everyone doing to accomodate the shorter and shorter certificate validation periods? My org has about 35 certs on various servers for quite a few things. If we eventually get to the target 47 day cert lifespan by 2029, it's going to be a nearly full-time job for someone to renew certs if we keep doing it the way we've always done it.”source ↗
“Our primary use is IIS/Radius and the admin overhead for the mandatory < 1-year certs on these 30+ servers has gotten way too high.”source ↗
“To my knowledge, there is currently no automated way to do a certificate rotation -- would love to be proven wrong.”source ↗
“In the past I just updated all the DC’s, but now with certs only lasting 199 days…. And eventually like 40 days…. I’d rather not update my original DCs as they last 1 year.”source ↗
“We're still rotating Entra Application Proxy certificates on a calendar because there is no clean ACME path into the custom-domain binding.”source ↗
“I have contacted them and didn't really get an answer and also couldn't get someone to talk that can really help us except tier 1 support.”source ↗
“For SSL the short lived thing is a pain.”source ↗
“Unless we find some magic solution that does all of the thing we need we'll be using this. It's better then excel with outlook calendar.”source ↗
“I have issued a re-key to the SSL certificate by accident and I can't replace it within the 72 hours time period. Is there a way to stop the revocation of the previous certificate?”source ↗
“I physicly can't install that on all the systems that use the cert within the given time frame.”source ↗
Where this came up
People with this problem also raised
- 2How do I install an SSL certificate on IIS?
- 4Which hostname should be included in a mail server TLS certificate?
- 3How to fix NET::ERR_CERT_AUTHORITY_INVALID with GoDaddy certificates
- 2How to manage multiple client domains without paying per domain
- 5Why are websites and APIs suddenly unreachable?
- 2How to manage internal DNS without running a domain controller