The renewal failed a month before anyone noticed
How production systems manage the lifetime of the credentials machines use to authenticate to each other, and why expiry still causes outages at organisations that know better.
A field guide to the machine credential lifecycle, built from ten published incidents at Bazel, DigiCert, Microsoft, Let's Encrypt and Ericsson, the ballots and RFCs cutting public certificate lifetimes to 47 days, and the issue trackers of the tools that do the renewing. After reading it you can compute the one number that predicts whether an expiry becomes an outage for any credential you own, decide where the renewal decision should live, and say what the 2026 to 2029 lifetime schedule will do to an estate that changes nothing else.
Certificate lifetime is not the number that governs this failure. The number that governs it is the slack, the count of consecutive silent renewal failures the window absorbs, and three independent sources spanning thirteen years converge on a slack of two to four attempts without ever naming it.
What you get out of it
- Slack, not lifetime, predicts the outage: the renewal window divided by the retry interval is how many silent failures you survive, and most managed certificates have a slack of one.
- Halving the lifetime without changing the renewal cadence does not reduce risk, it multiplies the number of times a year your single attempt has to work.
- Detection is half the recovery time. Surveyed organisations take 2.6 hours to identify a certificate outage and 2.7 hours to remediate it, and Bazel's renewal failed silently for a month before expiry.
- Shorter lifetimes move risk from the security column to the availability column: rotation itself caused a three-hour Azure control-plane outage and causes about 49 seconds of Kubernetes webhook failure every cycle.
- Your rotation lead time is not yours to choose. A validation defect at DigiCert forced 83,267 certificates to be revoked on 24 hours' notice, and one subscriber obtained a court order because it could not comply.
Scope
Why this, now. The 200-day tier of CA/Browser Forum ballot SC-081v3 came into force on 15 March 2026, Let's Encrypt stopped sending expiry warning emails in June 2025, and the public schedule cuts certificate lifetime to 47 days by 2029.
What it does not cover. Cryptographic algorithm choice and the post-quantum migration, certificate transparency and misissuance detection, human and workforce identity, secret scanning and leaked-credential response, and key ceremony compliance. The scope is the operational lifecycle of a machine credential.
Other field guides
The retry is the outage
A field guide to metastable failure: the class of outage where the system stays down after the thing that broke it has been repaired, because the ret…
30 sources · 19 organisations · 7 postmortemsYou cannot delete the dual write, only move it
A service commits a change and must announce it, and no mechanism makes both happen or neither. This guide reconstructs where eighteen organisations …
28 sources · 24 organisations · 3 postmortemsThe rule was already written down
A field guide to the machinery between an outage and the next design decision, reconstructed from six first-party incident reports (Cloudflare 2019 a…
34 sources · 24 organisations · 6 postmortems