The TLS Certificate Confidence Gap: Why Assumed Automation Is a Real Risk

A survey of 500 senior IT and security leaders, conducted by certificate authority Sectigo and reported by Help Net Security on 29 October 2026, has uncovered a significant gap between perceived and actual maturity in TLS certificate management. Forty percent of respondents described themselves as very prepared for monthly TLS certificate renewals, citing automated systems already in place. However, when asked more specific questions, only four percent said their certificate management was fully automated, and 61 percent reported that their organisation had experienced a certificate-related outage or incident in the past 12 months. The findings suggest widespread overconfidence in a foundational area of security and operational resilience.

Why this matters for UK organisations

TLS certificates underpin secure communications across web services, APIs, internal systems, cloud infrastructure and customer-facing platforms. When certificates expire unexpectedly or are misconfigured, the consequences range from service outages and broken integrations to browser security warnings that damage customer trust and trigger support escalations. With certificate lifespans continuing to shorten — monthly renewals are now a realistic operational requirement for many organisations — the margin for error in manual or partially automated processes is shrinking. For UK businesses with complex IT environments, hybrid cloud deployments or a large number of internet-facing services, unmanaged certificate sprawl is a genuine and frequently underestimated operational risk. The survey's core finding — that confidence significantly outpaces actual capability — is itself a risk indicator. Organisations that believe their certificate management is handled are less likely to audit it, which means problems are more likely to surface as incidents rather than being caught proactively.

What to review

IT and security teams should conduct an honest audit of their certificate management practices, starting with a complete and current inventory of all TLS certificates in use across the organisation, including those issued for internal services, APIs and cloud-hosted infrastructure that may not be centrally tracked. For each certificate, teams should confirm the renewal process, verify that automated alerting is in place ahead of expiry, and identify any certificates that are renewed manually and therefore at risk of being missed. Where automation is assumed to be in place, it is worth verifying that it is actually functioning correctly rather than relying on the assumption. Ownership of certificate management should be clearly assigned, with escalation paths defined for certificates approaching expiry without a confirmed renewal in progress.

Source: Help Net Security