Expired Certificates Cost Firms Over $250K, DigiCert Warns
A new DigiCert report finds certificate failures now cost firms over $250,000, with 34% already hit by an expired-cert outage. Here is why that matters to you.
DigiCert published its Certificate Management Outlook this week, and the numbers in it are worth sitting with even if you already know certificates expire on a schedule. Nearly one in four organizations surveyed said their worst certificate incident cost more than $250,000. That is not a rounding error in an IT budget. That is a line item someone has to explain to a board.
What the report found
DigiCert surveyed IT and security leaders on how they manage certificates and what happens when that management fails. Thirty-four percent of companies said an expired certificate had caused a service outage in the past year. Another 40% reported downtime tied to certificate mismanagement more broadly, things like wrong hostnames, broken chains, or a certificate deployed to the wrong environment. Nearly three-quarters lost at least five hours to certificate problems over the past year, and 21% lost 25 hours or more.
Most companies, 57%, file these outages under IT infrastructure rather than security. That tracks. A dead certificate doesn’t usually mean someone got hacked. It means a service stopped responding and someone had to figure out why at 2am.
Why the timing matters
DigiCert’s report lands right as the certificate lifecycle is getting shorter, not longer. The CA/Browser Forum’s phased rollout cut maximum TLS certificate validity from 398 days to 200 days back in March. That number drops to 100 days in March 2027, then 47 days in 2029. By DigiCert’s own math, organizations will need to renew certificates more than eight times as often as they did under the old rules, and run roughly 40 times as many domain validations.
More than half of the organizations DigiCert surveyed already manage over 1,000 certificates. Stack a shrinking validity window on top of that volume and the arithmetic stops being forgiving. A team that used to think about renewals once a year now has to think about them constantly, across every subdomain, API, and internal service that happens to be using TLS.
Only 10% of respondents said they already have real automation in place. The rest are working from some mix of spreadsheets, calendar reminders, and institutional memory, which is roughly the setup that produced the outages in the first place.
The gap between knowing and doing
Nearly three-quarters of the IT and security leaders DigiCert talked to expect their certificate volume to grow over the next two years, and 70% say they’re preparing for shorter lifespans. That leaves 30% who are aware of the change and have not started, which is a strange place to be with a deadline that’s already moving.
Part of the holdup is budget. More than half of organizations put over 10% of their security spend toward certificate management already, and cost still comes up as a barrier to further automation, alongside legacy systems that don’t play well with modern issuance protocols and a lack of internal buy-in for the project.
None of this is exotic. Mike Nelson, DigiCert’s Global VP and Field CTO, put it plainly in the report: an expired certificate can take down a service as fast as any other infrastructure failure, and spreadsheets won’t scale once renewals are happening every 47 days instead of every year. The organizations that get ahead of it are the ones that know what certificates they have, where they live, and who’s responsible for them, before the automation gets built.
What this means for you
If your team still tracks certificate expiration by memory or a shared spreadsheet, this report is a preview of what the next few years look like if nothing changes. The renewal cadence that felt manageable at 398 days gets a lot less forgiving at 200, and considerably worse at 47. The gap between “we know this is coming” and “we’ve actually automated it” is exactly where the $250,000 incidents happen.
To avoid becoming one of those numbers, consider using SSLcalendar.com to get reminders before your certificates expire. For teams managing larger certificate estates, SSLboard.com adds certificate surveying and vulnerability detection across your environment.
Sources: Help Net Security: Certificate failures can cost firms over $250,000, DigiCert: TLS certificate lifetimes will officially reduce to 47 days