ManageEngine has announced post-deployment automation for TLS certificates in Key Manager Plus, its certificate life cycle and machine identity management solution.
Key Manager Plus now automates the final stages of certificate renewal, pushing certificates to the target server, running configured scripts, restarting dependent services, and notifying stakeholders. Now, the entire certificate lifecycle runs without manual intervention.
As South African organisations continue to digitise customer and business services, ensuring cyber resilience and business continuity has become increasingly critical. The 2024 South African Reserve Bank's Directive on cybersecurity and cyber resilience calls on payment institutions to strengthen cyber resilience, regularly test recovery capabilities, manage third-party risks, and maintain the continuity of critical services.
Against this backdrop, the gradual reduction in TLS certificate validity periods is increasing the operational burden of certificate management. This makes end-to-end automation essential to reduce the risk of expired certificates, service disruptions, and compliance gaps.
Historically, most organisations had little incentive to automate certificate management. Even the organisations that adopted automation workflows limited it to discovery, periodic expiration alerts, and, in some instances, automated renewals. That changed when the CA/Browser Forum voted to reduce the maximum validity of public TLS certificates, phasing down from the legacy 398-day validity period to 200 days in March 2026 (current cadence). This will drop to 100 days by March 2027, and finally 47 days by March 2029.
“South African organisations are under growing pressure to secure an expanding mix of on-premises and cloud-based systems, often with lean IT teams and limited resources,” said David C Howell, regional sales director at ManageEngine South Africa. “As certificate lifespans continue to shrink, relying on manual renewal processes increases the risk of expired certificates, service disruptions, and unnecessary security gaps. Automating certificate life cycle management helps IT teams reduce that operational burden, while maintaining visibility and control across increasingly complex environments.”
Automating the last mile of certificate renewal
Getting the certificate live is the last step in the renewal process, and this post-deployment task has primarily been handled manually by many teams. While this works when teams renew one certificate a year, as certificate lifespans shrink and the same steps are repeated roughly eight times as often, manual errors become more likely, and the cost of an outage can run into the millions.
"Certificate renewal is rarely the hard part. The work that piles up on teams is what comes after it, at scale; pushing certificates to the server, restarting the services, and confirming they actually went live. End-to-end automation is what turns a 47-day renewal cycle from a scramble into something that runs on its own. With Key Manager Plus, we are eliminating the last manual step in the life cycle management loop," said Vasudevan Seshadri, director of product management at ManageEngine.
Quantifying the 47-day shift
To help organisations assess their exposure to the reduced certificate validity mandate, ManageEngine has also released a 47-day TLS impact calculator. It lets enterprises quantify what the mandate means for them based on three factors: the size of their certificate estate, their current renewal labour, and their outage exposure. From there, it compares those numbers against what they will look like once their TLS certificate life cycle is fully automated. That automation is what Key Manager Plus delivers, and it runs identically, whether teams deploy on-premises or in the cloud.
Find out more at www.manageengine.com.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version