# What Is Certificate Lifecycle Management (CLM)?

> Certificate Lifecycle Management (CLM) is the practice of discovering, issuing, deploying, renewing and revoking certificates in an automated way.

Source: https://ssl.sh/glossary/certificate-lifecycle-management/
Last updated: 2026-11-10

Certificate lifecycle management covers every stage of a certificate's life: discovery (knowing which certificates exist and where), request and issuance, deployment to servers, load balancers and CDNs, monitoring for expiry and misconfiguration, [renewal](https://ssl.sh/glossary/certificate-renewal/) with key rotation, and finally revocation and cleanup. Tooling ranges from a scheduled job running an [ACME](https://ssl.sh/glossary/acme/) client to commercial platforms that inventory thousands of certificates across clouds.

## Why it matters
Expired certificates are a recurring cause of outages, and shrinking lifetimes make manual processes untenable: the public maximum is 200 days as of November 2026, falling to 100 days in 2027 and 47 days in 2029. Reminder emails cannot be relied on either, since Let's Encrypt ended expiration emails on 2025-06-04. Good CLM automates renewal, supports ACME Renewal Information ([ARI](https://ssl.sh/glossary/ari/), RFC 9773) so a CA can ask clients to renew early, watches Certificate Transparency logs for certificates you did not expect, and checks the certificate actually served rather than the file on disk.

## Example
```bash
certbot renew --dry-run
systemctl list-timers | grep certbot
```

The first command tests renewal end to end; the second confirms a scheduler actually runs it.

## Common misconceptions
- **Auto-renewal means the job is done.** The new certificate must also be deployed and the server reloaded; many outages come from renewed files that nginx never loaded.
- **Calendar reminders are enough.** With 47-day certificates ahead, a missed manual step every few weeks is inevitable; automate instead.
- **CLM is only for large enterprises.** Even one site with a CDN, a load balancer and an API server has several places where a certificate can silently expire.

## Related terms

- [证书续期](https://ssl.sh/zh/glossary/certificate-renewal/): 证书续期是在证书到期前申请一张新证书来替换它，最好全自动完成并同时更换密钥对。
- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [ARI](https://ssl.sh/zh/glossary/ari/): ARI 是 ACME 的扩展标准（RFC 9773），由 CA 告诉客户端某张证书应该在哪个时间窗口内续期。
- [有效期](https://ssl.sh/zh/glossary/validity-period/): 有效期是证书中 notBefore 与 notAfter 两个时间之间的区间，只有在此区间内客户端才会接受这张证书。
- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。
- [密钥轮换](https://ssl.sh/zh/glossary/key-rotation/): 密钥轮换是按计划或在安全事件后，用新生成的密钥替换旧密钥，以限制密钥泄露造成损失的做法。
- [短期证书](https://ssl.sh/zh/glossary/short-lived-certificate/): 短期证书是有效期只有几天的 TLS 证书，靠快速过期而不是吊销来限制被盗证书可被滥用的时间。