How do I automate certificate management?

With the certificate lifetime reducing to 47 days in March 2029, it's now more important than ever to leverage automation to manage your certificates. Understand your options so that you can make the best choice for your configuration and available resources.

TLS certificate lifetimes are continuing to get shorter, with a maximum lifetime of 47 days beginning in March 2029. To maintain reliable services and reduce the risk of certificate-related outages, UIC is taking an automation-first approach to TLS certificate management.

The industry schedule for maximum TLS certificate lifetimes is:

• Until March 15, 2026, the maximum lifetime for a TLS certificate is 398 days. 

• From March 15, 2026, the maximum lifetime for a TLS certificate will be 200 days. 

• From March 15, 2027, the maximum lifetime for a TLS certificate will be 100 days. 

• From March 15, 2029, the maximum lifetime for a TLS certificate will be 47 days. 

UIC uses CERTInext to support automated certificate issuance and lifecycle management. ACME is the recommended automation method. CERTInext also supports REST API, SCEP, EST, CMP, and WAEP for systems where ACME may not be appropriate.

ACME Automation

Automated Certificate Management Environment (ACME) is an industry-standard protocol that automates certificate requests, validation, issuance, renewal, and revocation.

As certificate lifetimes continue to decrease, ACME reduces the need for manual certificate management and helps prevent outages caused by expired certificates.

Benefits of ACME

• Automated certificate issuance and renewal
• Reduces operational overhead and manual intervention
• Helps accommodate increasingly shorter certificate lifetimes
• Enables rapid certificate deployment across servers and applications
• Integrates with automation and DevOps workflows
• Reduces the risk of certificate-related service disruptions

Getting Started

Submit a TLS Server Certificate request to obtain credentials for certificate automation.

Individuals may request automation credentials for specific hostnames they manage, such as hostname.zone.uic.edu.

Your Unit Information Security Officer (UISO) may authorize team members to issue certificates for hostnames across their unit's DNS zone(s).

Manual certificate requests will be handled as exceptions. Depending on the use case and business need, a one-time manual certificate may be issued to bridge the transition to automation.

ACME Clients

Windows

Simple-ACME

Linux

Certbot

Other standards-compliant ACME clients may also work with CERTInext, but UIC support may be limited.

ACME Configuration

After your automation request is approved, you'll receive the information needed to configure your ACME client:

• EAB Key ID
• EAB HMAC Key
• ACME Directory URL

These credentials associate your ACME client with your approved certificate configuration in CERTInext.

Once configured, your ACME client can request and renew certificates without requiring a new service request for each renewal.