The 47-day clock has already started.

It was, until the schedule changed. Maximum certificate validity is falling toward 47 days by 2029, and domain-validation reuse toward 10 days. What used to be an annual reminder becomes a near-monthly cycle for every certificate, which is more than a spreadsheet and a person can carry.

For public certificates, free ACME automation and short-lived certificates are a real baseline, and we respect it. It stops at private, internal, appliance, and machine certificates, and at a single view across every authority you use. That gap is where a managed platform earns its place.

No. Certificate management sits outside the eight. The Australian anchors are the cryptography guidelines in the ASD's Information Security Manual, the deadline to move off today's public-key cryptography by the end of 2030, and APRA's CPS 234 and CPS 230 for regulated entities.

Partly. No cryptographically capable quantum computer exists today, so this isn't this week's emergency. But data captured now can be decrypted later, and the ASD wants a transition plan by the end of 2026. Build the ability to change algorithms on demand and you're ready whenever the deadline lands.

Almost every organisation carries some certificate risk, but a paid platform pays off once managing by hand starts to hurt, from roughly 25 to 30 certificates. Below that, the free baseline and a good calendar may be enough, and we'll tell you if that's you.