Today · 200 days
2renewals/certificate/year
JANAPRJULOCTDEC
For most teams, the shift to 47-day lifetimes will mean renewing each certificate eight to nine times a year instead of once. The calculator below estimates the labor, downtime, and headcount that change implies for your environment, drawing on industry benchmarks. It takes about 90 seconds.
Calculate my exposureEach colored square you see is a renewal event. Today, you renew a certificate roughly twice a year. By March 2029, that becomes every 31 days. Any one of them, missed, means an outage.
How big is your estate, and what does manual renewal cost?
What a missed renewal would cost your organization?
Tell us how much of your public certificate renewal you've automated so far, and how much your environment can't automate today.
Download your findings as a PDF report and share these numbers with your team.
What renewing by hand versus adopting automation looks like, on your estate.
annual labor cost at 47-day · 0 hrs/year
annual labor cost at 47-day · 0 hrs/year
See how Key Manager Plus handles ACME, integrated CAs, and continuous discovery. Bring your environment, and we’ll walk through what the 47-day cadence looks like for it.
At 0 renewals a year, even a 99.5% manual success rate adds up to ~0 preventable misses annually. Automation moves that error rate two orders of magnitude lower.
Lifting your automation coverage to the maximum your environment supports cuts expected misses from ~0 down to ~0 a year. That's a 0% reduction in outage exposure.
Modeled on 99.5% manual vs 99.99% automated per-renewal success. Residual reflects certificates that can't be automated (HSMs, embedded, compliance).
The first recommendation above (discover every certificate, every CA, every owner) is the one that most teams put off. Book a session with our certificate ops team and we’ll walk through your environment together.
Book the 15-minute auditEvery number here comes from your inputs. Here's the math behind it.
Renewing at 2/3 of certificate lifetime is the ACME / Let's Encrypt default.
Labor estimates cover the full manual workflow: CSR generation, validation, installation, and deployment verification. Per-renewal minute ranges are configurable in Step 1 of the wizard.
Non-automatable floor: a configurable share of certificates that cannot be automated. Typical examples: legacy systems, HSMs, air-gapped infrastructure, compliance-mandated chains, embedded devices.
Per-renewal success rates:99.5% manual, 99.99% automated. These are our chosen defaults, calibrated to be consistent with industry availability targets in Uptime Institute's 2025 Annual Outage Analysis (“Nearly 40% of organizations have suffered a major outage caused by human error over the past three years; 85% of those incidents stem from staff failing to follow procedures”) and ITIC 2024 (90% of organizations now require ≥99.99% availability for mission-critical systems). Both rates are user-overridable in Advanced settings.
Outage duration: the 90-minute default is a configurable assumption. Adjust it in Step 2 to match what a renewal failure would realistically take to detect, escalate, and resolve in your environment.
Downtime cost figures are anchored to ITIC's 2024 Hourly Cost of Downtime Survey (Part 1) (“the average cost of a single hour of downtime now exceeds $300,000 for over 90% of mid-size and large enterprises”) and Part 2 (“41% of enterprises indicate hourly downtime costs $1M to over $5M”; top verticals — Banking/Finance, Government, Healthcare, Manufacturing, Media/Communications, Retail, Transportation, Utilities — “topped the $5 Million mark”).
Important: the four-tier breakdown below is our derivation, not ITIC's. ITIC publishes aggregate figures (the three quoted above) but does not segment results into named SMB / Mid-market / Enterprise / Fortune tiers. We mapped those aggregates onto industry-size presets to make the calculator selectable. The SMB tier in particular falls outside ITIC's published scope and is calibrated against Datto's 2023 SMB downtime benchmark (~$8,000/hr). Every per-minute figure is user-overridable in the wizard.
| Tier | Default $/min | ≈ $/hr | Anchored to |
|---|---|---|---|
| SMB | $240 | $14,400 | Datto SMB benchmark (outside ITIC scope) |
| Mid-market | $1,800 | $108,000 | Below ITIC's $300k/hr floor — conservative midpoint |
| Enterprise | $5,000 | $300,000 | ITIC: 90%+ exceed $300k/hr |
| Fortune 1000 / regulated | $18,000 | $1.08M | ITIC: 41% report $1M–$5M+/hr; top verticals top $5M/hr |
Treat these as starting estimates, not survey-published bands. The “I know our number” option in Step 2 lets users substitute their own figure.
CA/Browser Forum Ballot SC-081v3 (approved April 11, 2025) is the binding industry mandate for the 47-day TLS lifetime by March 15, 2029.