Standard renewal logic fires a fixed number of days before expiry. For certificates with a total lifetime of only a few days — Let’s Encrypt 6-day certs, IoT device identities, short-lived intermediates — “30 days before expiry” is meaningless. TigerTrust detects these certificates automatically and switches to a fraction-of-lifetime renewal schedule so the renewal window is always proportional to the certificate’s actual validity period.
Short Lived Certificates

​
What it is

Any certificate whose total validity is 14 days or fewer is classified as short-lived and displayed with a Short-lived chip in the inventory. Instead of renewing at a fixed offset, TigerTrust renews these certificates after a third of their lifetime has elapsed — so a 6-day certificate begins renewal on day 2, leaving a 4-day window for the automated flow to succeed and retry if needed. If the CA also publishes an ARI window for the certificate, that window takes priority over the fraction rule.

​
When to use it

  • Operate with Let’s Encrypt’s short-validity certificates without configuring a custom renewal threshold per certificate.
  • Manage IoT device identities that are re-issued daily or weekly without manual intervention.
  • Issue short-lived intermediates for code-signing pipelines and trust that renewal fires before the cert is needed for the next build cycle.
  • Monitor which short-lived certificates are in the renewal pipeline at a given moment from the inventory view.

​
Set it up

No additional setup is required. TigerTrust automatically applies the lifetime-fraction rule to any certificate it discovers or issues with a total validity of 14 days or fewer. You will see the Short-lived chip appear in the inventory immediately after import or issuance.
1

Confirm short-lived classification

Open Certificates and filter by the Short-lived chip or look for the badge on individual certificate rows. Certificates classified as short-lived display the chip in the Tags column area.
2

Check the renewal schedule

Click a short-lived certificate to open its detail page. Go to the Renewal tab. The scheduled renewal date and the source used (ARI window, lifetime fraction, or fixed days) are shown here.
3

Adjust the threshold if needed

The 14-day threshold can be changed in Settings > Renewal policy. Set it lower to restrict the rule to only the shortest certs, or higher to apply fraction-based scheduling to a wider range of short-validity certificates.

​
What you’ll see

In the Certificates inventory, short-lived certificates display a Short-lived chip. Their detail page shows the fraction-based renewal window on the Renewal tab instead of a standard day countdown. The renewal queue includes a Source column that reads short-lived-fraction for these certificates, making it clear which scheduling rule is in effect.

Renewal Info ARI

The ARI window takes precedence over the fraction rule when available.

Certificate Renewal

The renewal workflow and automation policy.

ACME

Short-lived Let’s Encrypt certificates commonly use the ACME protocol.