Certificate authority failures, container sprawl, post-quantum cryptography: a rising tide of issues means CIOs need a strategy to manage certificates and machine identities.
I wrote this almost two years ago (Before Leaflet) when a CA was about to exit the market after failing to manage certificates securely enough; and ten years ago I wrote about the same thing with another certificate authority, and this week I wrote about the same thing with another certificate authority.
Every time the message that certificate management needs to be automated; this isn't just tactical IT any more, this is something CIOs need to have a plan and a budget to automate because the intervals between failures are getting shorter, the exploits are coming more quickly (thanks to AI and bad CA practices), the browser vendors' responses are getting faster and the response is to ratchet down certificate lifecycles more and more until everyone has to automate and certificates can become essentially ephemeral.
And even in 2026, I don't think most organisations have got the message (or if they have, the budget to deal with it). By hand it might take you a year to migrate from one CA to another; if you're lucky you might do it in a month or two. Automation could take that down to an afternoon and most of that will be planning maintenance windows.
It's not just domains; its email authentication, it's containers and machine identity (and pretty soon, agents). Oh, and it's post-quantum cryptography rolling out.
certificate management
certificate lifecycles
CA migration
automation
ACME
certificate inventory
machine identity
post-quantum cryptography