By 2029, a digital certificate will be valid for at most 47 days. Does your board know how many the company has?

The day a date took down a carrier

On December 6, 2018, millions of customers of O2, one of the largest mobile carriers in the UK, lost mobile data for about a day. According to the British press, around 32 million users were affected, counting the carriers that run on O2’s network. SoftBank, in Japan, was hit as well. There was no attack. A digital certificate had expired inside the software of an Ericsson system, and Ericsson came forward to take full responsibility for the failure.

In February 2020, Microsoft Teams went down for a few hours for the same reason; Microsoft itself said an authentication certificate had expired. In April 2023 it was Starlink’s turn, and Elon Musk explained the outage in one line: an expired certificate at a ground station.

Three top-tier technology companies. No intruder. Just a date nobody was watching.

Trust that expires by design

A digital certificate is the document that lets one system prove to another that it is who it claims to be. I am not talking here about the e-CPF or e-CNPJ (Brazilian signing certificates) we use to sign documents, but about the certificates systems use with each other. It is what makes the padlock appear in the browser, what authenticates a payment API, what lets one device talk to another. And every certificate has an expiry date. Not by accident, but by design: the whole point is that trust gets renewed from time to time.

The problem is that renewal depends on someone knowing the certificate exists. Keyfactor’s 2024 “PKI & Digital Trust” report, produced with the Ponemon Institute, found that organizations had on average nine certificate-related incidents in the previous 12 months. Each one took, on average, 2.6 hours just to identify and another 2.7 hours to fix, tying up about eight people.

More than five hours to find and fix something that had a scheduled date.

From 398 to 47 days

That math is about to get tighter. In April 2025, the CA/Browser Forum, which brings together certificate authorities and browser makers, approved without a single vote against a gradual reduction in the maximum lifetime of the certificates used by websites, the ones that make the padlock appear in the browser. The e-CPF and e-CNPJ follow ICP-Brasil rules and are not part of this. The limit was 398 days. Since March 2026, it has been 200. In March 2027, it drops to 100. In March 2029, to 47 days.

By my count, that means renewing each certificate almost eight times a year. A company that today tracks expiry dates in a spreadsheet, with a reminder in someone’s calendar, will multiply by eight its chances of missing one.

The change is good for security. A short-lived certificate limits the damage when a key leaks. But it charges a price to anyone who still treats this as a manual job.

The code the board doesn’t see

Certificates are only the most visible part. Underneath sit the algorithms, libraries and protocols that make cryptography work, scattered across systems the board has never seen and that IT itself sometimes doesn’t know exist.

Capgemini’s “Future encrypted” report, from July 2025, surveyed executives at 1,000 large companies in 13 countries. Only 39% said their board discusses the implications of quantum computing. Among executives at companies that have already started preparing, only 35% keep a centralized inventory of keys, algorithms and certificates. An ISACA survey from April 2025, of more than 2,600 professionals, found an even starker picture: only 5% of organizations had a defined strategy for the quantum threat.

You cannot govern what you cannot see. And much of a company’s digital trust today simply does not show up on any risk dashboard.

Even algorithms have an expiry date

This is where the conversation reaches post-quantum cryptography, by a route that may come as a surprise. We tend to think of the algorithm as the permanent part of trust. The certificate expires; the algorithm stays.

It doesn’t. In the draft of NIST IR 8547, from November 2024, the US standards institute proposed deprecating after 2030, and disallowing after 2035, the RSA and elliptic-curve algorithms that underpin most of the internet’s security today. The reason is the progress of quantum computers, which could, in theory, break those algorithms.

In Brazil, the shift has already begun. In January 2026, ITI, which runs ICP-Brasil, the public key infrastructure behind the country’s official digital certificates, published Normative Instruction No. 35, which adds the post-quantum algorithms ML-DSA and ML-KEM to the accepted list. There is no deadline yet for dropping the old ones. But the door is open.

Trust has an expiry date at every layer. The difference is that some layers expire in 47 days and others in ten years, and the ones that expire slowly are precisely the hardest to replace.

Three decisions to bring trust out of the dark

1. Build the inventory, with an owner and a date. Know which certificates, keys and algorithms the company uses, where they are, who is accountable for each one and when each one expires. Without that, any migration plan is a guess.

2. Automate renewal before 2029. With a 47-day lifetime, renewing by hand stops being a reasonable option. Automation needs to be in place while the limit is still 200 days, not when it is already 47.

3. Bring one indicator to the board. It does not need to be technical. How many certificates the company has, how many expire in the next 90 days, how many critical systems depend on algorithms with a set date to be retired. Three numbers that fit on one slide and take the issue out of invisibility.

The question for the next meeting

The next time the board discusses technology risk, ask a question that almost never makes the agenda: what is the next expiry date that could stop the company, and who knows about it?

O2 found out the answer one December morning, with millions of customers out of signal. You can find out sooner.