Every organisation relies on machine identities, even if it does not call them that. Certificates, API keys, tokens, service accounts, cloud workloads and AI agents all use credentials to prove who they are and what they can access. In most businesses, these now far outnumber employee accounts.
Human identities usually have clear processes. People are given access when they join, their access changes when their role changes, and it is removed when they leave. Machine identities often have none of this. They are created quickly, rarely reviewed and sometimes forgotten. That creates both security risk and a real chance of outages.
The Change to TLS Certificates
TLS certificates are the most common type of machine identity, and they are about to need much more attention.
The CA/Browser Forum approved Ballot SC-081v3 in April 2025. Under this ballot, the maximum lifespan of a public TLS certificate is being cut from 398 days to 47 days. The limit dropped to 200 days in March 2026, will fall to 100 days in March 2027 and will reach 47 days in March 2029.
At 47 days, each certificate needs replacing roughly every six to seven weeks. For a business with a few thousand certificates, that means renewals every working day. Handling this through spreadsheets and calendar reminders is not realistic.
See also: How Drone Tech Genuinely Transforms Building Exterior Care in the City
Why Expired Certificates Matter
When a certificate expires, the system relying on it stops being trusted. Customers see browser warnings, APIs reject requests and internal services fail to connect to one another.
These failures are more common than many people expect. ProofID has reported that up to 40% of P1 and P2 outages in its managed service customer base were caused by certificate expiry. Most of these incidents could have been avoided with better tracking and automated renewal.
Step One: Know What You Have
Most organisations do not have a full list of their certificates. When they scan their environment properly, they often find ten times more than they expected.
Certificates can be found on web servers, load balancers, firewalls, cloud platforms and internal applications. Some are bought centrally, while others are created by developers or automated tools without being recorded.
A useful inventory should be kept up to date automatically. For every certificate, it should show who owns it, which application uses it, which authority issued it, when it expires and where it is installed. Without an owner, no one is responsible for fixing a problem when it happens.
Step Two: Automate and Set Rules
Once you know what you have, the next step is automation. Certificate lifecycle tools can request, renew and install certificates without manual work, which removes the risk of a missed expiry date.
Automation should follow clear rules. Decide which certificate authorities are approved, which key types and lengths are allowed and when wildcard certificates can be used. Without these rules, automation simply keeps weak or unneeded certificates running.
This is the core of a machine identity security programme: find every identity, give it an owner, automate its lifecycle and check it against policy on an ongoing basis.
AI Agents Add to the Problem
AI agents are becoming a large new group of machine identities. They log in to systems, pull data and carry out tasks, often on behalf of a person. They do this using API keys, tokens and service accounts.
These agents should be treated like any other identity. Each one should have an owner, access only to what it needs, credentials that expire, and a quick way to shut it off. Because agents can be set up in minutes, the number of these credentials can grow fast and go unnoticed.
A Simple Plan to Get Started
Begin with a discovery scan so you know the size of the task. Fix the most important services first, such as customer-facing websites and core business systems. Test automated renewal on a small group of certificates before rolling it out further. When that is working, extend the same approach to API keys, service accounts and AI agents.
To track progress, measure how many certificates have an owner, how many renew automatically and how many outages are caused by expiry.
Machine identities are now a core part of security. Organisations that manage them properly will have fewer outages and fewer gaps for attackers to use.
