Your certificate infrastructure isn't ready for post-quantum cryptography if it can't handle 90-day TLS certificates today.
That's the reality facing your security team. With TLS certificate lifetimes moving toward 47 days, operational gaps in your PKI are becoming impossible to ignore. Manual renewal processes that barely kept pace with annual certificates will collapse under monthly rotation requirements. Those same fragmented ownership patterns and incomplete inventories blocking your automation efforts are the vulnerabilities that will prevent crypto-agile migration when NIST finalizes post-quantum standards.
Certificate automation isn't just about keeping your websites online. It's the foundation for cryptographic agility you'll need when quantum-resistant algorithms become mandatory.
What You Need Before Starting
Complete certificate inventory across your infrastructure:
- Every TLS certificate (web servers, load balancers, API gateways)
- Internal certificates (service mesh, microservices, databases)
- Code signing and device certificates
- Certificate authorities (both public and private)
Don't rely on spreadsheets. Use discovery tools that can scan your network and cloud environments continuously. Venafi, cert-manager, Lemur, and commercial PKI platforms offer discovery capabilities, but verify they can reach your containerized workloads and ephemeral cloud resources.
Ownership mapping for each certificate use case:
- Who requests certificates for each application or service?
- Who approves certificate requests?
- Who receives expiration alerts?
- Who has authority to renew?
Organizations face challenges with fragmented certificate ownership and incomplete inventories. Fix this before you automate, or you'll just automate chaos. Create a RACI matrix that maps certificate types to teams. If multiple teams share responsibility for a single certificate, you've found your first point of failure.
Baseline cryptographic standards documentation:
- Current cipher suites in use
- Key lengths and algorithms by certificate type
- Systems that can't support modern TLS (document these legacy constraints)
- Compliance requirements (PCI DSS, HIPAA, FedRAMP) that dictate cryptographic controls
You'll need this baseline to measure crypto agility later.
Step-by-Step Implementation
Phase 1: Establish Certificate Authority Hierarchy
Start with your internal PKI before touching public certificates.
Configure a two-tier CA structure:
- Offline root CA (air-gapped, HSM-backed)
- Online issuing CA for day-to-day operations
If you're using Active Directory Certificate Services:
# Configure CRL distribution points
certutil -setreg CA\CRLPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%3%8.crl\n2:http://pki.yourdomain.com/CertEnroll/%3%8.crl"
# Set validity periods that align with automation cycles
certutil -setreg CA\ValidityPeriod "Days"
certutil -setreg CA\ValidityPeriodUnits "90"
For cloud-native environments, use AWS Certificate Manager Private CA or Google Cloud Certificate Authority Service. Both integrate directly with Kubernetes cert-manager.
Phase 2: Deploy ACME Protocol Infrastructure
The Automatic Certificate Management Environment (ACME) protocol, defined in RFC 8555, is your automation foundation.
Deploy an ACME server:
- For public certificates: Use Let's Encrypt or your commercial CA's ACME endpoint
- For internal certificates: Deploy Smallstep or configure your existing CA for ACME
Install ACME clients across your infrastructure:
# For web servers (certbot example)
certbot certonly --webroot -w /var/www/html -d app.yourdomain.com
# For Kubernetes (cert-manager)
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml
# Configure issuer
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: internal-ca
spec:
acme:
server: https://acme.yourdomain.com/directory
privateKeySecretRef:
name: acme-account-key
Phase 3: Implement Certificate Lifecycle Automation
Create automated workflows for the entire certificate lifecycle:
Issuance automation:
- Template-based certificate requests tied to service catalogs
- Automated validation (DNS-01 or HTTP-01 challenges)
- Integration with deployment pipelines
Renewal automation: Configure renewal at 2/3 of certificate lifetime. For 47-day certificates, that's 31 days. Set monitoring alerts at 50% (23 days) to catch automation failures.
Revocation automation: Link certificate revocation to decommissioning workflows:
# Example webhook for infrastructure-as-code
POST /api/certificates/revoke
{
"serial": "1A2B3C4D5E6F",
"reason": "cessationOfOperation",
"triggered_by": "terraform_destroy"
}
Phase 4: Build Crypto Agility Framework
This is where automation enables post-quantum readiness.
Create algorithm inventory: Document every system's cryptographic capabilities. You need to know which systems can handle:
- RSA 4096-bit keys
- ECDSA P-384 (lighter weight alternative)
- Post-quantum algorithms (ML-KEM, ML-DSA when available)
Implement certificate templating: Separate certificate policies from certificate requests. When you need to migrate algorithms, you'll update templates centrally rather than reconfiguring thousands of endpoints.
Example template structure:
certificate_template:
key_algorithm: "${CRYPTO_STANDARD}" # Variable for future updates
key_size: "${KEY_LENGTH}"
signature_algorithm: "${SIGNATURE_HASH}"
validity_days: 47
Test hybrid certificate chains: Some post-quantum migration strategies will require dual certificates (classical + PQ). Your automation platform must support multiple certificate types per endpoint.
Validation: How to Verify It Works
Certificate discovery completeness: Run your discovery tool, then manually deploy a test certificate somewhere it shouldn't be. If your tool doesn't flag it within 24 hours, your inventory isn't complete.
Renewal automation resilience: Force-expire a non-critical certificate. Verify:
- Automated renewal triggers within your defined threshold
- New certificate deploys without manual intervention
- Services restart or reload as needed
- Monitoring confirms successful renewal
Crypto agility readiness: Change your certificate template to use a different key algorithm (RSA to ECDSA, or vice versa). Measure:
- How many systems can accept the new certificates without modification
- How long it takes to propagate the change across your infrastructure
- Which legacy systems require manual intervention
If you can't complete this test in under a week, you're not crypto-agile.
Maintenance and Ongoing Tasks
Monthly certificate lifecycle review:
- Audit new certificates issued
- Review failed renewals and root causes
- Update ownership mapping for organizational changes
Quarterly crypto inventory updates:
- Scan for deprecated cipher suites
- Identify systems still using SHA-1 or RSA 1024-bit keys
- Document progress toward crypto-agility targets
Annual PKI architecture assessment:
- Review CA hierarchy against current threat models
- Evaluate new automation capabilities from your CA provider
- Test disaster recovery procedures for CA compromise
Continuous post-quantum monitoring: Track NIST's post-quantum standardization timeline. When ML-KEM and ML-DSA become formalized, you'll need to:
- Update certificate templates with hybrid algorithm support
- Test PQ certificates in staging environments
- Plan phased rollout based on system crypto-agility scores
Your certificate automation platform is the mechanism for this migration. If it can't handle algorithm changes without manual reconfiguration, you're building technical debt that will compound when quantum-resistant requirements arrive.
Organizations that treat certificate automation as purely operational efficiency are missing the strategic value. Crypto agility isn't a future project; it's the outcome of automation decisions you're making right now.
