Lesson 25 of 35CLMCLM

What is CLM?Certificate Lifecycle Management explained

Finds every TLS and machine certificate an organization owns — including the forgotten and shadow ones nobody's tracking — renews them automatically before they expire and take a service down, and runs the private certificate authorities that issue them, so the trust machines place in each other never quietly breaks.

By Cyber Tool Stack Editorial TeamReviewed August 4, 2026

Verified August 4, 2026Sources: digicert.com, akamai.com, manageengine.com

The lesson

The expiring passports every machine carries

Every secure website and service proves its identity with a certificate that has a hard expiry date. Learn why forgotten certificates still take major services offline, and why renewal is going fully automatic.

If it helps, think of it as… the passport that expires mid-trip

A certificate is a machine's passport: issued by an authority everyone recognizes, valid until a printed date, and useless the moment that date passes — no grace period, no arguing at the border. Now imagine holding tens of thousands of passports, each expiring on its own schedule, where one missed renewal strands a service and everyone using it.

Discover

inventory every certificate, including forgotten ones

Issue

a trusted certificate authority signs it

Deploy

installed on servers, load balancers, and devices

Monitor

every expiry date tracked across the estate

Renew

automatically, well before anything breaks

…then the loop starts again — this runs continuously, not once.

Certificates are discovered, issued, deployed, watched, and renewed in a loop that increasingly has to run without any humans involved.

What it does

Every secure website, API (application programming interface), and internal service proves its identity with a digital certificate — a small signed document that binds a cryptographic key to a name, issued by a certificate authority (CA) that both sides already trust. It is how your browser knows it reached the real site, and how machines authenticate each other with no human in the loop.

Certificate Lifecycle Management (CLM) is the practice of keeping all of them working: finding every certificate the organization has — including forgotten ones — renewing each before it expires, and running the private certificate authorities, the internal public key infrastructure (PKI), that issue certificates for internal-only systems.

The problem it solves

A certificate expires like a passport: valid one minute, worthless the next, with no grace period. When one lapses on a production system, browsers throw warnings, machine-to-machine calls fail, and the service is effectively down — an outage caused by a calendar, not an attacker. Major online services have gone dark exactly this way, and a typical organization owns thousands of certificates, each on its own clock, many installed years ago by people who have since left.

The math is about to get much harder. Rules agreed by the CA/Browser Forum — the industry body for browsers and certificate authorities — are shrinking the maximum lifetime of public TLS (Transport Layer Security) certificates in steps: to 200 days in 2026, 100 days in 2027, and just 47 days by 2029. At that cadence, renewal by spreadsheet and calendar reminder stops being merely risky and becomes impossible. Automation shifts from nice-to-have to the only way the estate keeps working.

How it works, step by step

Discover: scan networks, cloud accounts, and clusters to inventory every certificate in use — including shadow certificates nobody registered and expired ones still installed.
Issue: request certificates from public authorities for internet-facing systems, and from a private internal authority for machine-to-machine traffic inside the company.
Deploy: push each certificate into the server, load balancer, or device that needs it, instead of leaving installation to hand work.
Monitor: track every expiry date and alert owners well before a lapse — and flag weak keys and outdated algorithms along the way.
Renew: use the ACME protocol (Automatic Certificate Management Environment) to prove control of a name, reissue, and install the replacement automatically, with no human in the loop.

What it doesn't do

A valid certificate proves you are talking to the domain named on it — nothing more. Phishing sites carry perfectly valid certificates, so the browser padlock means "encrypted and authenticated," not "safe" — the classic beginner misconception. CLM also doesn't manage human logins or passwords; certificates are overwhelmingly machine identities, the credentials of servers and services rather than people.

Renewal automation alone isn't the finish line either: the coming migration to post-quantum algorithms will mean reissuing certificates at enormous scale, which only works if the inventory — step one above — is actually complete.

How it fits the stack

Certificates are the public half of the key material managed alongside encryption and key management. The machine identities they represent are the non-human counterpart of the accounts in identity and single sign-on, and a certificate's private key is exactly the kind of powerful secret that privileged access management vaults for humans and services alike.

Terms you just met

Each links to its plain-language definition in the glossary.

The field guide

Evaluating this category

A second pass for buyers: market context, distinctions that matter, and what to weigh when tools in this category start looking alike.

Every secure connection between two machines rests on a certificate: a small signed file that vouches for who a website, service, or device actually is. Certificates are quietly everywhere — on load balancers, API gateways, internal microservices, Kubernetes ingresses, employee laptops — and every one of them has an expiration date. Certificate lifecycle management is the discipline of knowing where all of those certificates are, renewing them before they lapse, and running the authorities that issue the private ones.

It's unglamorous work that stays invisible right up until it isn't: a single forgotten certificate expiring in production has knocked major banks, telecoms, and cloud services offline, because the moment a certificate expires, everything that trusted it starts refusing the connection.

The problem it solves

The certificate that runs a service is easy to set up once and easy to forget forever — until the day it expires and takes the service down with it. As organizations moved to microservices, containers, and service meshes, the number of certificates exploded: machine identities now vastly outnumber human ones, and no spreadsheet a human maintains by hand keeps up with thousands of certificates issued, rotated, and retired across dozens of environments.

The pressure is getting sharper, not gentler. The CA/Browser Forum's ballot SC-081v3, passed in April 2025, phases down how long a public TLS certificate may live: the 398 days long allowed fell to a maximum of 200 days in March 2026, drops to 100 days in March 2027, and lands at just 47 days from March 2029. A certificate that once needed renewing roughly once a year will soon need it every six weeks — far past the point where manual, calendar-driven renewal is survivable.

How it works

A certificate lifecycle platform starts by finding what you already have: scanning networks, cloud accounts, and clusters to build an inventory of every certificate, including the unknown and shadow ones nobody was tracking. From there it watches expiration dates and alerts owners well ahead of a lapse, and — more importantly — automates the renewal so alerts rarely need a human at all.

That automation runs largely on ACME (RFC 8555, standardized in 2019), the protocol Let's Encrypt popularized: a client proves it controls a domain, and the certificate authority issues and later renews the certificate through an API, with no ticket and no human in the loop. The platform then deploys the renewed certificate where it's needed — into a load balancer, a Kubernetes secret, an MDM profile, a web server — rather than leaving an admin to copy files by hand. For certificates that stay inside the organization, the same platform often runs a private certificate authority, issuing internal certificates that only the organization's own systems are configured to trust.

Certificates vs encryption keys

This category sits right next to encryption and key management, and the two are easy to conflate because both deal in cryptographic material. The distinction is what the material is for. A key management system guards the secret keys that encrypt data, so that data stays unreadable to anyone without permission. Certificate lifecycle management handles the certificates that prove identity — that the machine on the other end of a connection is genuinely who it claims to be — and keeps those certificates from expiring and breaking trust. One protects confidentiality; the other protects authenticity and availability. In practice they overlap (a certificate is a public key with a signed identity attached, and its private key still has to be stored safely), which is why both live in the data domain, but the tools and daily concerns are different.

Choosing one

Start with discovery: a platform that can't find the certificates you've already lost track of can't stop them from expiring. Confirm it reaches every environment you actually run — public cloud, on-prem, Kubernetes, and endpoints — because the certificate that takes you down will be the one nobody remembered.

Then weigh automation and reach. CA-agnostic tools manage certificates from many public and private authorities through one console, which matters if you don't want to be locked to a single CA. Broad ACME support and ready-made deployment integrations decide whether renewal is truly hands-off or just tracked more neatly. And if you issue a lot of internal certificates, look for a built-in private CA — running your own PKI well is hard, and a tool that does it for you removes a whole category of fragile, home-grown scripts.

Capability taxonomy

What buyers typically evaluate when comparing tools in this category.

Certificate discovery & inventory: Finds every certificate across on-prem, cloud, and Kubernetes environments — including unknown, expired, and shadow certificates nobody was tracking.
Automated issuance & renewal: Issues and renews certificates automatically through ACME and direct CA integrations, so nothing depends on someone remembering to do it by hand.
Expiry monitoring & alerting: Watches expiration dates across the whole estate and alerts owners well before a certificate lapses and causes an outage.
Private CA & internal PKI: Runs internal certificate authorities and PKI to issue the private certificates that secure machine-to-machine and internal service traffic.
Deployment integrations: Pushes issued certificates directly into load balancers, Kubernetes, MDM, and web servers instead of leaving admins to install them by hand.
Crypto-agility & rotation: Inventories the algorithms and keys in use and rotates them at scale, including preparing for the migration to post-quantum cryptography.