Cryptographic Agility at Scale: Queueing Models and Failure Bounds for Certificate Lifecycle Automation at Scale

Abstract

The CA/Browser Forum's staged reduction of maximum TLS certificate lifetimes toward 47 days converts certificate management from a periodic administrative task into a continuously running control system. Renewal load scales inversely with lifetime, so an estate renewing four times per year at 398-day lifetimes renews approximately thirty-one times per year at 47 days an eightfold increase in job arrival rate against issuance capacity that is fixed by certificate authority throughput, hardware security module signing rate, and validation dependencies. The operational consequence is unmodeled. Existing guidance is advisory prose that prescribes automation without characterizing when automation itself saturates. We formalize enterprise certificate lifecycle automation as a multi-class M/G/c queueing system with hard deadlines, in which each certificate is a recurring job whose deadline is its expiry instant and whose slack is the safe renewal window the fraction of lifetime during which renewal may be attempted. We derive a closed-form upper bound on estate-wide outage probability as a function of lifetime, renewal-window fraction, retry policy, and service capacity, and invert it into a capacity-planning inequality giving the minimum throughput required to hold outage below a target. We validate against 38 months of telemetry from a hybrid estate of 214,000 certificates spanning on-premises certificate authorities, cloud hardware security modules, and commercial certificate managers, achieving 0.94 correlation between predicted and observed renewal-failure rates. We then parameterize signing cost by algorithm and identify the post-quantum crossover: under ML-DSA-65, the estate exceeds capacity at 47 days with a validation-failure retry storm that classical parameters do not exhibit. The dominant failure mode inverts availability risk overtakes compromise risk as lifetimes shrink.