Impending changes limiting digital certificates to 90-days could disrupt businesses that are not … [+]
In the late 1990s, the world held its breath as the infamous Y2K bug loomed over the horizon, threatening to disrupt every facet of modern life. Businesses across the globe scrambled to prepare, often spending exorbitant amounts to safeguard against potential fallout.
Fast forward to today, and organizations face a new challenge that echoes the Y2K crisis: Google’s impending mandate to limit encryption certificates to a 90-day lifecycle. This “90-day apocalypse,” while lacking a precise start date, calls for proactive measures rather than last-minute scrambles.
The Y2K Parallels
As the year 2000 approached, businesses knew the exact timing of the potential crisis. Despite this foresight, many delayed the inevitable and then succumbed to the pressure, making hasty and often irrational decisions.
I know, because I was one of the beneficiaries of their complacence. I made pretty good money on a consulting basis, coming in to help clients update and prepare for Y2K at the end of 1999. The companies that fared better were those that prepared methodically, avoiding the last-minute rush. This lesson is crucial as we face the transition to 90-day digital certificates.
Unlike Y2K, the 90-day certificate mandate does not have a fixed implementation date, which can foster complacency. However, the uncertainty surrounding the exact timing should not deter businesses from taking action. On the contrary, it highlights the need for preparedness, mirroring the importance of early planning seen in Y2K preparations.
The Impending Shift to 90-Day Certificates
In the world of digital security, certificates play a pivotal role in ensuring the authenticity and integrity of online communications. Traditionally, these certificates have had lifespans that could extend several years, making management relatively straightforward. However, Google has signaled a shift towards shorter lifecycles.
Google justifies the proposed change with sound logic. “Reducing certificate lifetime encourages automation and the adoption of practices that will drive the ecosystem away from baroque, time-consuming, and error-prone issuance processes. These changes will allow for faster adoption of emerging security capabilities and best practices, and promote the agility required to transition the ecosystem to quantum-resistant algorithms quickly.”
I recently discussed the implications of this shift with Kevin Weiss, CEO of Sectigo. He emphasized the challenges of managing TLS certificates manually and supported the necessity for automation to maintain compliance and security.
The Risks of Manual Management
Many organizations still manage certificates using spreadsheets, a method that may have sufficed in the past but is woefully inadequate for the impending changes. Weiss recounted a visit to a large pharmaceutical company in Germany, which manages approximately 25,000 public certificates without a management system.
This scenario is not unique and highlights a significant vulnerability: the risk of certificates expiring unnoticed, leading to downtime and potential security breaches.
It wouldn’t be the first time. Expired certificates have led to high-profile disruptions, including with Microsoft, Cisco, Google and Starlink. Microsoft saw both Teams and Outlook go down in separate incidents in 2023, alongside Starlink which experienced an outage in April of last year, but this isn’t only a recent trend. Cisco had three separate outages between 2018 and 2023 and Google Voice went down back in 2021. Manual tracking methods are prone to errors and oversight, which can be costly both in terms of security and operational efficiency.
Preparing for the 90-Day Cycle
The transition to 90-day certificates is not a simple “flip of the switch.” It requires thorough planning and the implementation of automated certificate lifecycle management (CLM) systems. CLM solutions provide a comprehensive approach to managing digital certificates, ensuring timely renewals, deployments, and revocations.
Automating these processes reduces the workload on IT departments, allowing them to focus on more strategic initiatives. More importantly, it mitigates the risk of human error, ensuring that certificates are managed consistently and securely.
The Case for Early Action
The uncertainty of the 90-day apocalypse timing should not be a reason for inaction. Instead, businesses should view this as an opportunity to get ahead of the curve. Early adopters of automated CLM systems will not only ensure compliance but also position themselves to handle future challenges, such as the transition to quantum-ready certificates.
As Weiss highlighted, quantum computing is on the horizon, and current cryptographic algorithms like RSA will become vulnerable. Preparing for this transition now, while also addressing the 90-day certificate mandate, will save businesses from the double jeopardy of being caught unprepared for both changes.
Learn from Y2K, Act Now
The Y2K crisis taught us the value of preparation and the pitfalls of last-minute fixes—both operationally and financially.
The looming 90-day certificate mandate presents a similar challenge. While the exact timing remains uncertain, the need for action is clear. By investing in automated CLM systems and planning for the transition, businesses can avoid the chaos of the 90-day apocalypse and ensure their digital security is robust and future-proof.
There’s no reason not to get ahead of it. The closer you get to D-Day, the more expensive it will get. Let this be a call to action for organizations to prepare now, ensuring they are ready for the challenges ahead and not left scrambling at the eleventh hour.