A live inventory you can trust
Continuous discovery of every certificate from any authority, public and private, so nothing is counting down where you can't see it.
Certificate and private key managementInternal research
The 47-day clock has already started.
Public certificates will last 47 days by 2029, down from about a year. We find every certificate you hold and match you to a platform that renews them before they expire.
Free. No fit, no obligation.
The problem
Renewal stopped being a once-a-year job.
The CA/Browser Forum's schedule cuts the maximum life of a public TLS certificate from about 398 days to 200, then 100, then 47 days by 2029. Domain-validation reuse drops to 10 days. A once-a-year task becomes close to monthly, for every certificate you own.
The Australian Signals Directorate (ASD) adds a second deadline: off today's public-key cryptography by the end of 2030, with a transition plan by the end of 2026. Both are published, and they set the work whether or not a certificate has ever caused you trouble.
47 daysthe maximum life of a public TLS certificate by 2029, down from about 398.
Architecture
Four problems the schedule creates.
Certificate management used to be a calendar reminder. Now it is four distinct problems at once.
- 01
Seeing what you have
Most teams track certificates in a spreadsheet and their memory. Industry surveys suggest only about a third of organisations have a complete, current view of every certificate they own.
- 02
Renewing before they expire
At 47 days, manual renewal does not scale. One missed certificate takes down a website, an API, or an internal service, and the outage arrives without warning.
- 03
Every authority, not one
Certificates come from several public and private authorities, each with its own console. When one authority loses trust, as Entrust did in 2024, every certificate from it needs replacing at once.
- 04
The clock on quantum
Data captured today can be decrypted once a capable quantum computer exists. Long-lived data is a present-tense risk, and the ASD deadline to move off today’s cryptography is fixed.
Certificate and private key management
You can’t automate what you can’t see.
Every vendor demonstrates automated renewal, and it only works on certificates you know about. Outages come from the ones you don't: a certificate set up two years ago, on an appliance nobody owns now.
So the first job is discovery: a live inventory of every certificate across your estate, public and private. Get it right and renewal, governance, and the quantum transition have something real to work from.
What you get
What good certificate management gives you.
What good looks like once the schedule is against you.
Renewal that keeps pace with 47 days
Enrolment and renewal automated through open standards, so certificates replace themselves on schedule and an expiry never becomes an outage.
Ready to change algorithms on demand
Crypto-agility, the ability to find and re-issue certificates as standards change, so the move to post-quantum cryptography is a managed process, not a scramble in 2030.
What to look for
What can the top platforms do?
Buying certificates from one authority is procurement. Managing every certificate across its whole life, from any authority, is the job now. These are the capabilities that separate a platform that governs your estate from a console that only sells you certificates.
Continuous discovery across the estate
Finding certificates on your network, in the cloud, and on appliances, beyond the ones already listed. A "scan the internet" feature is usually Certificate Transparency log monitoring, which is public and free: table stakes.
Authority-agnostic lifecycle
Managing certificates from every public and private authority in one place, so a trust event at one authority becomes a bulk re-issue rather than an emergency.
Automated enrolment and renewal
Open standards like ACME and SCEP doing the renewal work, so a 47-day cycle runs without a person in the loop.
Policy and governance
Central rules for who can issue what, and from where, so certificate sprawl does not quietly rebuild itself.
Expiry monitoring and alerting
A warning well before a certificate lapses, tied to a named owner, so the renewal has somewhere to land.
A private certificate authority as a service
Issuing internal and machine certificates without standing up and maintaining your own PKI, described as what it is: a delivery model, not magic.
A crypto-agility inventory
Knowing which algorithms sit where across your estate, so the transition off today's cryptography before 2030 is planned from evidence.
Maturity
Where most teams sit today.
Certificate management maturity, tier by tier.
Focused
Certificates tracked in a spreadsheet, renewed by hand, discovered when one expires and something breaks. It worked when certificates lasted a year. At 47 days it will not. Many mid-market teams sit here.
Typical features
- Certificates tracked in a spreadsheet
- Renewal done by hand
- Expiry found when something breaks
- No single owner
Broad
A complete, live inventory, renewal automated from any authority through open standards, and expiry tied to a named owner.
Typical features
- A complete, live inventory
- Discovery across every authority
- Renewal automated through ACME and open standards
- Expiry tied to a named owner
- Alerts well before the deadline
Best fit before the 47-day cut
Comprehensive
Everything Broad does, plus central policy, a private authority delivered as a service, and a crypto-agility inventory ready for the post-quantum move. The most room to adapt as the rules change. It’s the tier for teams that issue their own internal certificates or answer to APRA.
Everything in Broad, plus
- Policy enforced centrally
- A private authority run as a service
- A crypto-agility inventory
- Re-issue at scale when an algorithm changes
- A post-quantum transition plan
Tekspace Research
We research the certificate and private key management field.
Internal research
Certificate and Machine Identity Management
Finds every certificate you own and renews it before an expiry causes an outage.
Vendors assessed
- AppViewX
- CyberArk Venafi
- DigiCert
- GlobalSign
- Keyfactor
- Sectigo
What we test
- Discovery across every CA
- Automated renewal (ACME)
- Crypto-agility for post-quantum
Same tests on every product. The scores publish with the benchmark.
The Tekspace Fit Method
How we’d help you choose.
Five steps from the problem you have to the product that fits, each leaving you with something you keep.
- 01
Understand
For certificate and private key management
Agree the outages you can’t afford, the 47-day schedule, and the 2030 post-quantum deadline.
What you get
Problem brief. The agreed problem and what success looks like.
- 02
Map
For certificate and private key management
Every certificate authority you use, public and private, the estate they cover, and who owns renewal.
What you get
Environment map. Your tools, identity, users and constraints.
- 03
Narrow
For certificate and private key management
Only platforms that discover across every authority you use and automate renewal your way.
What you get
Shortlist with reasons. Why each option made it, and why the rest did not.
- 04
Prove
For certificate and private key management
A discovery run on your own estate shows what’s out there before you commit.
What you get
Proof-of-value results. How each option did against your problem.
- 05
Enable
For certificate and private key management
Automate renewal, give every certificate an owner, and set the policy that stops sprawl coming back.
What you get
Handover plan. Deployment, training and who owns what.
Questions we hear most.
Even where we have a product we like, we’ll recommend something else if your context calls for it.
- No consulting fee
- If nothing fits, we say so
- Vendor-independent
- Operating since 2006