- CLM is the end-to-end practice of discovering, monitoring, renewing, and retiring certificates.
- Five stages repeat for every cert: issue, deploy, monitor, renew, retire.
- As TLS lifetimes shrink toward 47 days, monitor and renew happen up to 8× more often.
- Most outages trace back to no discovery, no ownership, or manual tracking — solvable as one system.
What is certificate lifecycle management?
Certificate Lifecycle Management (CLM) is the practice of discovering, monitoring, renewing, and retiring digital certificates across their entire lifespan — so trusted services never go down because a certificate quietly expired.
CLM sits on top of one or many certificate authorities. The CA issues; CLM discovers, tracks, renews, and retires across the whole estate, regardless of which CA signed each certificate.
The goal is operational: certificates as a continuous, automated system rather than a series of manual tasks tracked in a spreadsheet.
The five stages of a certificate’s life.
Issue: a CA validates the requester and issues the certificate to a domain or workload.
Deploy: the certificate is installed on servers, load balancers, or secrets stores.
Monitor: track expiry, risk, chain health, and unexpected changes — the first key stage where the lifecycle usually breaks.
Renew: re-issue and redeploy ahead of expiry, ideally automatically — the second key stage as 47-day lifetimes arrive.
Retire: revoke and archive certificates that are no longer in use, so the inventory stays honest.
Why the lifecycle falls apart at scale.
No discovery: certificates nobody tracked expire silently and take services down.
Manual tracking: spreadsheets and calendar reminders cannot keep pace with renewal volume.
No ownership: when a cert breaks, no one knows who owns it or what it affects.
Shrinking lifetimes: the 47-day era multiplies renewals roughly 8× beyond what people can handle by hand.
CLM works when the whole lifecycle is one system.
Continuous discovery feeds a single inventory across public, cloud, and internal systems.
Real-time monitoring covers expiry, risk, and change — not quarterly snapshots.
A Machine Trust Graph maps blast radius so renewals and revocations carry impact context.
Automated renewal and deployment close the loop, so the cycle runs hands-off and zero expirations becomes a realistic target.