Internal private root and intermediate Certificate Authorities seem permanent until their 5 or 10-year expiration dates arrive, breaking VPNs, mTLS, and internal services. Here is the PKI migration playbook.
Marcus Chen
Cloud Systems Specialist
Enterprise infrastructure architectures rely on private Public Key Infrastructure (PKI)—powered by HashiCorp Vault, Microsoft Active Directory Certificate Services (AD CS), AWS Private CA, or Smallstep—to secure internal corporate communications. This internal PKI issues certificates for corporate VPN endpoints, Kubernetes service-to-service mutual TLS (mTLS), developer SSH certificates, and internal microservices.
When an internal PKI hierarchy is established, architects typically assign generous lifespans: 10 to 20 years for the Root CA, and 5 years for subordinate Intermediate CAs. Because these dates lie so far in the future, the original engineers rarely document the rollover procedure before moving to other companies. When the expiration date finally arrives, the entire internal corporate network collapses: VPNs disconnect, Kubernetes service meshes reject pods, and database replication halts.
Under X.509 cryptographic standards (RFC 5280), a Certificate Authority cannot issue an end-entity (leaf) certificate with a validity period extending beyond the expiration date of the issuing CA itself. This creates the Subordinate CA Pinch:
| CA Tier | Standard Lifespan | Recommended Rollover Window | Issuance Restriction Near Expiry |
|---|---|---|---|
| Root Certificate Authority | 10 to 20 Years | Initiate rollover at T-3 Years | Cannot sign intermediate CAs exceeding root expiry |
| Subordinate / Intermediate CA | 5 to 7 Years | Initiate rollover at T-18 Months | Leaf cert validity automatically truncated to CA end date |
| End-Entity / Leaf Certs (mTLS) | 90 to 365 Days | Automated ACME / Vault renewal | Rejected if CA expired |
If an intermediate CA has only 6 months of validity remaining, any 1-year leaf certificate request will be rejected or silently truncated to 6 months, causing unexpected early outages.
Even if your Root and Intermediate CAs have years of remaining validity, internal PKI outages frequently occur due to short-lived revocation artifacts:
Migrating enterprise root trust requires deploying the new Root CA to thousands of employee laptops, servers, and embedded IoT devices. To prevent downtime during multi-month truststore rollouts, use Cross-Signing: sign the new Intermediate CA with both the old Root CA and the new Root CA simultaneously. Systems holding either root will successfully validate the certificate chain.
Register all private CA tiers, CRL endpoints, and OCSP responder certificates in RenewOS to ensure multi-year cryptographic timelines are managed systematically.
Continue exploring compliance guidelines and renewal tactics.
With the industry transitioning from 398-day certificates to short-lived 90-day certificates, manual reminders are obsolete. Learn how modern IT teams eliminate browser security warnings and microservice outages.
Cloud database providers rotate their regional TLS Certificate Authority bundles every 4 to 5 years. Failing to update client truststores before the mandatory cloud cutover halts all database queries.
When an EV code signing certificate expires, build pipelines grind to an immediate halt and Windows SmartScreen flags your software as unknown malware. Here is how to manage cryptographic release keys.