On Dec. 22, 2018, the federal government entered what would ultimately become its longest shutdown in history. In the days and weeks that followed, more than 80 TLS certificates used by government websites expired, resulting in web outages for organizations including NASA and the Department of Justice. With employees furloughed and no one around to renew these certificates, services such as the electronic document filing system and Public Access to Court Electronic Records (PACER) systems were rendered inoperable.
These outages driven by expired web certificates were among the highest profile events to impact the U.S. government, but they were neither the first nor the last. Despite the clear negative impact these outages had, certificate expirations continue to affect government at the local, state and federal levels. Last year, at the height of the COVID-19 pandemic, the state of California realized that its virus reporting system had been hindered by an expired certificate. This resulted in a backlog of more than 300,000 test results at a time when public health officials were still scrambling to understand the virus and its spread. Even corporate giants on the cutting edge of technology have fallen victim to certificate expirations, including Spotify, Microsoft and Google. It can truly happen to anyone at any time.
Certificates are an integral part of security today, but issues concerning their management continue to plague IT teams. Fortunately, modern security solutions increasingly focus on certificate automation, helping to ensure that outages like these need no longer occur.
How and why outages happen
At their core, the purpose of SSL (properly known as TLS) certificates is to ensure secure communications between two machines. They both authenticate the legitimacy of a website or internal server and validate that data communication between the server and client is secure. If a certificate expires without being replaced, these tasks cannot be accomplished, which can have serious consequences. Without a valid certificate, secure connections fail — preventing internal systems from doing their jobs and causing broad failures across critical technology systems.
Despite their importance, the sheer volume of certificates in use today makes it easy to understand how a business or government agency could neglect to realize that a certificate is about to expire. For years, organizations tended to manage their certificates manually, often via a spreadsheet or other document. Today, with tens of thousands of certificates in use, such practices are difficult at scale.
Automation is increasingly critical
The impact of an outage caused by an expired certificate varies, but it can easily cost an enterprise hundreds of thousands of dollars per hour. And though it may be harder to assign a specific dollar value to outages impacting government, the implication is clear — these outages have a major impact and should be avoided at all costs. Situations like a government shutdown or global pandemic cannot always be predicted, making effective lifecycle management and automated management of security assets like web certificates critical.
Fortunately, as the explosion of internet-of-things devices, web pages and other assets in need of certificates has continued, automated solutions have become increasingly common. Automating certificate management ensures that no expiring certificates are overlooked, preventing costly outages and ensuring business continuity. It also enables IT personnel to devote their time and efforts elsewhere. Manual certificate management is both time consuming and — as history has clearly shown — prone to human error. With automation in place, staff efforts can be directed to areas of greater need.
As the government expands its adoption of modern technology, certificate automation ensures that agencies can scale appropriately, without worrying about overwhelming their IT teams with new websites, devices or applications. A business might lose money if its website goes down, but if users are unable to access the government services that they rely upon, they may lose faith in the system. Uptime is critical.
Making human error history
When any process is left in human hands, mistakes happen. We even have a name for it: human error. But when it comes to SSL certificates, agencies need no longer fear human error the way they used to. Processes like certificate management are time consuming and require extreme precision, but the rise of automation has helped keep organizations more secure than ever while increasing the efficiency and effectiveness of their IT teams. Whether another government shutdown is on the horizon or another unexpected public health crisis strikes, today’s public and private organizations alike can use automation to ensure that they are well positioned to navigate any catastrophe.
