Certificate Lifecycle Management

The previous lesson showed that every claim measured in the handshake rests on work done long before the connection. The most fragile part of that work is time: every item has a validity window, and when the window closes, the item stops passing even if its fields have not changed, its signature has not broken, and its authority is still standing. This is the most common cause of outage a certificate infrastructure runs into, and the cause is not a break — it is a calendar.

This lesson measures the lifecycle in terms of the renewal window: how many workdays manual renewal takes and how many items go unnoticed, how many connections an expired item drops, which items automation closes and which it opens, and how many items’ worth of maintenance shortening lifetime adds. The key storage layer and the secret rotation window were measured in the Cloud Governance course; what is measured here is the item’s own calendar.

• PK21. A renewal transaction is replacing an item with a new one before it expires. The yearly transaction count is the number of items times the number of renewals within the year.
• PK22. Manual renewal has a touch-time in minutes per item, and a portion of renewals go unnoticed. The miss rate, touch minutes, and detection time are fictional model values.
• PK23. An expired item drops the connections it carries until it is noticed and fixed; dropped connections are the item count times the connection rate times the detection time.
• PK24. The renewal window is a third of the lifetime, and one attempt is made per day within the window; the attempt count gives the number of spare opportunities left if the first attempt fails.
• PK25. Automation’s system items are shared: they do not multiply with item count, but when one breaks it affects the whole inventory.

The Ledger of Manual Renewal

Manual renewal’s cost is three separate numbers, and none substitutes for another: time spent, items that go unnoticed, and connections the missed item drops.

// lifetime.mjs — fictional item inventory and renewal model. IS A MODEL.
// The regional measurement network is FICTIONAL: counts, rates, minutes, and ratios are made up.
export const CLASS = [
  // name, count, connections per hour, manual renewal minutes
  ["meter endpoint", 4100, 2, 11],
  ["internal service", 26, 30, 18],
  ["staff identity", 262, 1, 6],
  ["branch transfer", 9, 4, 25],
].map(([name, count, rate, min]) => ({ name, count, rate, min }));

export const ITEM = CLASS.reduce((t, s) => t + s.count, 0);
export const MISS_RATE = 0.025;    // rate missed in manual renewal (fictional)
export const DETECT_TIME = 6;      // time to notice and fix an expired item, hours
export const LEARNING_WINDOW = 29.5;     // from the third lesson: revocation learning window, hours
export const AUTOMATION = ["renewal service", "the service's own identity",
  "reload after renewal", "monitoring and alerting", "spare renewal path"];

export const yearly = (lifetime) => Math.ceil(365 / lifetime);
// The renewal window is a third of the lifetime; one attempt is made per day.
export const attempts = (lifetime) => Math.floor(lifetime / 3);

export const write = (g) => (h) =>
  h.map((v, i) => (i ? String(v).padStart(g[i]) : String(v).padEnd(g[0]))).join("");

// renewal.mjs — the cost of manual and automatic renewal, missed items, and the lifetime filter
import { CLASS, ITEM, MISS_RATE, DETECT_TIME, LEARNING_WINDOW, AUTOMATION, yearly, attempts, write }
  from "./lifetime.mjs";

const compute = (lifetime, auto) => {
  let [txn, minutes, missed, dropped] = [0, 0, 0, 0];
  for (const s of CLASS) {
    const n = yearly(lifetime) * s.count;
    txn += n;
    if (auto) continue;
    minutes += n * s.min;
    const k = Math.round(n * MISS_RATE);
    missed += k;
    dropped += k * s.rate * DETECT_TIME;
  }
  return { txn, minutes, missed, dropped };
};

console.log(`inventory ${ITEM} items, ${CLASS.length} classes; ` +
  `rate missed in manual renewal ${MISS_RATE * 100}% (fictional)`);
console.log(`an expired item is noticed and fixed in ${DETECT_TIME} hours (fictional)\n`);

const fmt1 = write([28, 12, 12, 11, 14, 16]);
console.log(fmt1(["path (365-day lifetime)", "renewals", "manual min", "workdays", "missed items",
  "dropped conn."]));
for (const [name, auto] of [["manual renewal", false], ["automatic renewal", true]]) {
  const h = compute(365, auto);
  console.log(fmt1([name, h.txn, h.minutes, Math.round(h.minutes / 480), h.missed, h.dropped]));
}
const manual365 = compute(365, false);
console.log(`items automation closes: ${manual365.missed} missed renewals, ` +
  `${manual365.minutes} min of manual work`);
console.log(`system items automation adds: ${AUTOMATION.length}`);
for (const k of AUTOMATION) console.log(`  ${k}`);
console.log(`items affected if one of these (the service's own identity) breaks: ${ITEM}`);

// Cost of manual renewal per class (at a 365-day lifetime).
const fmt2 = write([20, 10, 12, 10, 14, 16]);
console.log("\n" + fmt2(["class", "items", "manual min", "missed", "conn./hr", "dropped conn."]));
for (const s of CLASS) {
  const n = yearly(365) * s.count, k = Math.round(n * MISS_RATE);
  console.log(fmt2([s.name, s.count, n * s.min, k, s.count * s.rate, k * s.rate * DETECT_TIME]));
}

// Lifetime filter: the effect of shortening on renewal volume, attempt margin, and revocation need.
const fmt3 = write([12, 14, 14, 12, 18, 20]);
console.log("\n" + fmt3(["lifetime", "yearly txns", "daily txns", "attempts", "manual workdays",
  "revocation needed"]));
for (const lifetime of [365, 90, 30, 7, 1]) {
  const auto = compute(lifetime, true), man = compute(lifetime, false);
  console.log(fmt3([`${lifetime} days`, auto.txn, Math.round(auto.txn / 365), attempts(lifetime),
    Math.round(man.minutes / 480), lifetime * 24 > LEARNING_WINDOW ? "yes" : "no"]));
}
console.log(`revocation learning window ${LEARNING_WINDOW} hours (third lesson); ` +
  `an item with a shorter lifetime than this drops on its own before the notice`);

inventory 4397 items, 4 classes; rate missed in manual renewal 2.5% (fictional)
an expired item is noticed and fixed in 6 hours (fictional)

path (365-day lifetime)         renewals  manual min   workdays  missed items   dropped conn.
manual renewal                      4397       47365         99           111            1458
automatic renewal                   4397           0          0             0               0
items automation closes: 111 missed renewals, 47365 min of manual work
system items automation adds: 5
  renewal service
  the service's own identity
  reload after renewal
  monitoring and alerting
  spare renewal path
items affected if one of these (the service's own identity) breaks: 4397

class                    items  manual min    missed      conn./hr   dropped conn.
meter endpoint            4100       45100       103          8200            1236
internal service            26         468         1           780             180
staff identity             262        1572         7           262              42
branch transfer              9         225         0            36               0

lifetime       yearly txns    daily txns    attempts   manual workdays   revocation needed
365 days              4397            12         121                99                 yes
90 days              21985            60          30               493                 yes
30 days              57161           157          10              1283                 yes
7 days              233041           638           2              5230                 yes
1 days             1604905          4397           0             36017                  no
revocation learning window 29.5 hours (third lesson); an item with a shorter lifetime than this drops on its own before the notice

A one-year lifetime means manually renewing four thousand three hundred ninety-seven items takes 47,365 minutes, meaning 99 workdays. That is one person doing no other work for ninety-nine days, and the number comes not from the inventory itself but from the touch minutes.

The class table shows where this load comes from: 45,100 minutes, ninety-five percent of the total, from a single class — meter endpoints. Four thousand one hundred items and eleven minutes per touch. The remaining three classes together take 2,265 minutes. Ninety-three percent of the inventory produces ninety-five percent of the manual work; the lifecycle decision is therefore not an inventory decision, it is a class decision.

The missed-items column writes the second cost. The two-and-a-half-percent rate corresponds to 111 items, and these 111 items drop entirely on their own, without an attack, because they have expired. The connections they drop number 1,458. The distribution reverses here: internal services miss only one item, but because they carry 780 connections per hour the dropped connections come to 180 — while staff identities miss seven items but drop only 42. The number of missed items does not give the risk; the traffic the missed item carries does.

The branch-transfer row shows zero, and this is not a guarantee — it is a rounding result: two and a half percent of nine items is under one item. In small classes rate-based measurement does not produce meaning; there, counting one by one is required.

The six-hour detection time is also an assumption, and what it depends on has to be stated. An expired item produces no warning at all; the only thing it produces is a verification failure on the other side. Who that failure reaches varies by class — in an internal service a call chain breaks immediately and gets noticed, while at a meter endpoint only that endpoint’s data stops arriving. Detection time is therefore the result of a monitoring decision: without an audit that scans the validity window in advance, the time depends on how noisily the item falls.

This table’s silent assumption is that the inventory is complete. Renewal only happens to an item sitting on the list; an item not on the list does not get renewed, and when it expires, no one is expecting it. A certificate infrastructure always has items like this — issued for a test and left in place, unclaimed by anyone during a handover, embedded inside a device image and forgotten. An item invisible in the inventory has no measure either: the 99 workdays and 111 missed items above are only as accurate as the inventory is correct.

Time distribution is also an assumption. The calculation above counts 4,397 renewals as spread evenly across the year; in practice, items are mostly issued in batches — hundreds get produced on the same day during a rollout, a migration, or a renewal campaign. Items produced on the same day drop on the same day. In that case the 99 workdays of load is not spread across the year but crammed into a few days, and the miss rate rises on those days too. The second number the lifecycle needs to measure is therefore not the total, but the renewal count on the busiest day.

What Automation Closes and Opens

Automatic renewal zeroes out all three columns at once: 47,365 minutes, 111 missed items, and 1,458 dropped connections. This is the cleanest result among the defenses measured in this course; in exchange for the items it closes it does not stop any legitimate work. Its cost is paid not at runtime but at setup time, and setup happens once.

In exchange it adds five system items, and these items are not like the others. They do not multiply with the inventory — there are five of them whether it is four thousand three hundred ninety-seven items or not. In exchange, because they are shared, when one breaks it affects the whole inventory. The clearest example of this on the list sits second: the renewal service’s own identity. That identity is one that can request items on the authority’s behalf, and when it breaks, the number of items affected is 4,397.

The third item on the list says why renewal is not just a signing job. When a new item is produced and written to disk, the work is not done; the process using the item has to reread it. A service that keeps holding the old item in memory keeps presenting the expired item while a brand-new item sits on disk, and no external check can tell the two apart — the configuration is correct, the file is current, the item presented is stale. The last link in the renewal chain is not the signature — it is the reload.

The trade-off here is the lesson’s central sentence. In manual renewal there are 111 scattered breakage points, and each one drops exactly one item; none affects another, all are visible, and all are fixed separately. Automation zeroes out these 111 points and replaces them with one — but that single point carries 4,397 items at once. Total breakage count falls, and the scope of a single breakage grows. This has the same shape as the second lesson’s root table: consolidation shrinks the count while growing the radius.

The Bill for Shortening Lifetime

The last table closes the question the third lesson left open. The revocation notice’s learning window averaged 29.5 hours and could be narrowed but not zeroed out. Shortening lifetime to one day makes that window unnecessary: a twenty-four-hour item drops on its own before the revocation notice reaches clients. The revocation problem is not solved — it disappears.

The bill is in the same row. Yearly transactions rise from 4,397 to 1,604,905, daily transactions from twelve to four thousand three hundred ninety-seven. This volume cannot be managed manually — the manual workdays column shows 36,017, meaning a hundred-person team’s year and a half. Short-lived items turn automation from a choice into a requirement.

The third column writes a less visible cost. Because the renewal window is a third of the lifetime, the spare-attempt margin shrinks along with the shrinking lifetime: at a one-year lifetime you can retry every day for 121 days, at ninety days thirty, at seven days two, at one day zero. At a one-day lifetime, if the first renewal attempt fails there is no second chance; the item drops. Shortening does not shrink the risk, it changes the kind of risk — at a long lifetime the risk is an item being stolen and used for a long time, at a short lifetime the risk is the renewal channel not working for forty-eight hours.

The table’s middle rows say something too. The last column changes only in the bottom row: at a ninety-day or seven-day lifetime the revocation notice is still needed, because the twenty-nine-and-a-half-hour learning window stays below both. Shortening lifetime from a year to seven days cuts the time a stolen item could be used by fifty times but does not remove the revocation mechanism; removing it requires dropping below twenty-four hours, and just before that threshold daily transactions jump from six hundred thirty-eight to four thousand three hundred ninety-seven. The gain is continuous, but the cost rises in a threshold; that is why the lifetime-shortening decision usually lands somewhere in the middle, at a point where transaction volume stays manageable and the spare-attempt margin is not zeroed out.

That is why choosing a lifetime does not look at a single number but at where two curves cross: how long an item could remain in the wrong hands, versus how long the renewal channel is expected to run without interruption. Assuming the second duration without measuring it turns a short lifetime from a defense into a fragility.

Summary

• Manually renewing 4,397 items at a one-year lifetime takes 99 workdays; ninety-five percent of that comes from a single class, 4,100 meter endpoints. The lifecycle decision is a class decision, not an inventory decision. The number rests on the assumption that the inventory is complete and durations are spread evenly across the year.
• Manual renewal misses 111 items and drops 1,458 connections. The number of missed items does not give the risk: 1 internal-service item drops 180 connections while 7 staff items drop 42.
• Automation zeroes out all three columns at once and stops no legitimate work; in exchange it adds 5 shared system items. These items do not multiply with the inventory, but when one breaks it affects 4,397 items at once.
• The trade-off is between breakage count and scope: 111 scattered, mutually independent breakage points in manual renewal, versus 1 point and a 4,397-item radius in automation.
• Shortening lifetime to 1 day makes the revocation notice unnecessary, because the item drops before the notice; the cost is yearly transactions rising to 1,604,905 and the spare-attempt margin in the renewal window dropping from 121 to 0.

Next Step

Across five lessons, everything measured protected the same thing: the connection. A certificate ties together the two ends of a transport channel, and its job ends when that channel ends. Where the channel ends, though, usually is not where the content is headed — it reaches a log collector, gets decrypted there, processed, stored, and continues on its way over another channel. At every hop the content becomes plaintext, and there is a layer that can see it in that moment. The next lesson closes out this topic by carrying the question to the content itself: how many intermediate layers see the content, how many items keeping the key at the edge pulls off the server, and what capabilities are lost in exchange.