Protect Your Infrastructure with a Backup CA

Why a second CA is an architecture decision

TLS certificate lifetimes stand at 200 days. They drop to 100 days in March 2027 and reach 47 days by March 2029. Domain validation reuse falls to 10 days over the same period, so revalidation runs about as often as renewal does. At that cadence, the CA you issue from stops being a procurement question and becomes an architecture decision. A CA outage during renewal becomes a failover instead of an expiry event. A root distrust becomes a re-issue from a root already in your pipeline. The catch is that a second issuer only helps if you enrolled it before you needed it.

What the session covers

• Why shorter lifetimes and higher certificate volumes turn CA choice into an architecture decision
• What a second CA absorbs across TLS, S/MIME, and code signing roots
• Splitting issuance so one provider's rate limits do not cap your peak volume
• Running two issuers behind one automation layer using ACME or the REST API, with one inventory and one policy
• Where to start, whether that means assessing your exposure, running a pilot, or bringing us into an architecture review

Your presenter

Tim Reidel is Director of Product Management at SSL, where he leads the certificate and PKI portfolio. He works with enterprises on certificate issuance, automation, and recovery.