3 min read
For organisations still paying for Domain Validated certificates, changing the certificate source could release budget for the lifecycle controls they increasingly need.
Many organisations pay twice for public SSL/TLS certificates.
They pay a certificate authority for the certificate subscription. They then pay for the people and processes required to request, validate, deploy, monitor and renew each certificate. As certificate lifetimes shorten, these operational costs recur more frequently. This creates an opportunity to reconsider where the certificate budget produces the most value.
A Multi-Year Plan Does Not Mean A Multi-Year Certificate
The maximum validity period for publicly trusted SSL/TLS certificates is now 200 days. It will fall to 100 days in March 2027 and 47 days in March 2029.
Organisations can still purchase annual or multi-year plans from commercial certificate authorities. However, these plans provide commercial coverage for a series of shorter certificates. They do not provide one certificate that remains valid throughout the agreement.
Each replacement certificate must still pass through issuance, deployment and monitoring. Depending on the renewal timing and certificate authority policy, domain-control validation may also need to be repeated.
Commercial plans can provide valuable support, assurance and service commitments. Purchasing the certificate does not remove the need to manage its lifecycle. See the current certificate validity schedule. Learn how commercial multi-year plans work.
Which Certificates Could Be Free?
Let’s Encrypt provides free, automated Domain Validated certificates. These are suitable for many websites, APIs and other public-facing services where proving control of the domain is sufficient.
This creates three practical categories.
Replace
Standard public DV certificates may be suitable for migration to Let’s Encrypt. These are the clearest candidates for reducing certificate purchasing costs.
Retain
Some certificates should remain with commercial or specialist providers. Reasons can include policies requiring Organisation Validated (OV)or Extended Validated (EV) certificates, contractual support, procurement requirements, technical requirements or specific assurance needs.
Other certificate types, including qualified certificates, code-signing certificates and email-signing certificates, require different services.
Govern
Free, paid and internally issued certificates all need to be discovered, deployed, monitored and renewed. A change of certificate provider does not remove these responsibilities.
TrustView provides a common management layer across these categories. Organisations can use Let’s Encrypt where free DV certificates meet the requirement, retain commercial or specialist certificates where necessary, and manage both alongside internally issued certificates through one lifecycle platform.
Let’s Encrypt provides free issuance, but does not provide OV, EV or direct support to certificate subscribers. The correct mix will therefore depend on each organisation’s requirements. Read the Let’s Encrypt service overview
Free Certificate Issuance Still Has An Operating Cost
A free certificate can still cause an outage if it expires, is deployed incorrectly or is missing from the organisation’s inventory.
To operate reliably, every certificate needs:
- A known service and owner
- Automated domain validation and issuance
- Secure deployment to the correct endpoint
- Monitoring of the certificate presented by the live service
- Alerts and escalation when something fails
- Records of renewal and deployment activity
The savings released from paid certificate subscriptions can be redirected into these lifecycle controls.
What Could The Economics Look Like?
Consider an illustrative organisation with:
- 500 paid public DV certificates
- An average annual certificate cost of €75
- 60% of the estate suitable for Let’s Encrypt
- Four lifecycle events per certificate each year under the coming 100-day maximum
- 30 minutes of internal work per lifecycle event
- An internal labour cost of €75 per hour
Moving 300 eligible certificates to Let’s Encrypt would avoid approximately €22,500 in annual certificate fees. Assuming four lifecycle events per certificate annually, automating 1,200 events would address approximately 600 hours of manual work. At €75 per hour, this represents up to €45,000 in reducible internal effort before allowing for residual oversight.
Combined with the avoided certificate fees, the illustrative gross annual opportunity is up to €67,500 before CLM platform costs and remaining operational work. The figures are illustrative rather than an industry benchmark. Actual certificate prices, labour costs and automation potential will vary.
A conservative business case should calculate:
Direct annual value = avoidable certificate fees + reducible manual effort
Reduced outage exposure, stronger control and better auditability provide additional value, but should be assessed separately from the direct savings calculation.
Use The Savings To Improve Lifecycle Control
TrustView enables organisations to manage certificates from Let’s Encrypt, commercial certificate authorities and internal private CAs such as Microsoft ADCS environments through one platform.
Security and infrastructure teams can use TrustView to:
- Discover certificates across internal and external environments
- Monitor certificates and the services where they are used
- Order certificates from multiple providers
- Automate issuance, installation and renewal
- Integrate certificate automation with DNS providers
This allows procurement teams to select the right certificate source for each use case without creating separate management processes for every provider. Paid certificates continue to play an important role. But automatically renewing every paid DV subscription may no longer be the best use of the certificate budget.
Assess The Opportunity In Your Certificate Estate
The starting point is a simple assessment:
- How much do you currently spend on public SSL/TLS certificates?
- Which certificates require commercial assurance or support?
- Which standard DV certificates could move to Let’s Encrypt?
- How much time is spent requesting, deploying and tracking renewals?
- How much of that work could be automated through TrustView?
The savings may not cover the complete investment in CLM for every organisation. For certificate estates with sufficient volume, they could offset a meaningful part of the cost while improving reliability across the entire environment.
This redirects budget from repeated certificate purchasing into lasting visibility, automation and operational control.
Find out which paid certificates could move to Let’s Encrypt, what manual work could be automated and how much of the resulting saving could be redirected into lifecycle management.
