Multi-CA Strategy: Building Certificate Infrastructure Resilience for the Short-Lifetime Era

At 47-day lifetimes, you're renewing certificates constantly. If your CA has an outage during your renewal window, you have days — not months — before certificates expire. A multi-CA strategy provides resilience: if one CA is unavailable, you failover to another without service disruption.

Why Multi-CA Matters More with Short Lifetimes

• Renewal frequency — At 47-day lifetimes, you renew every ~30 days. Any multi-day CA outage risks expiration
• Revocation events — When a CA must mass-revoke certificates (it happens), you need an alternative issuer immediately
• Policy changes — CAs can change terms, pricing, or validation requirements with limited notice
• DORA compliance — Financial entities must avoid concentration risk on single ICT providers — including CAs
• Trust store changes — Browser root programs can distrust a CA (Symantec/DigiNotar precedent). Multi-CA ensures continuity

Multi-CA Architecture

Primary + Fallback

Designate a primary CA (e.g., Let's Encrypt) and one or more fallbacks (e.g., ZeroSSL, Google Trust Services, Buypass):

• ACME client configured with primary CA endpoint
• On renewal failure after N retries, automatic failover to fallback CA
• Alert on primary CA failure for investigation
• Periodic test issuance from fallback CA to verify it works

Load-Balanced Issuance

For large-scale deployments: distribute certificate issuance across multiple CAs by domain, environment, or round-robin. Reduces dependency on any single CA. Useful for staying within Let's Encrypt rate limits at high certificate volumes.

Hybrid: Public CA + Private CA

Use public CAs for external-facing endpoints and private CA for internal services. Internal CA is fully under your control — no dependency on external providers. Only external certificates are subject to the CA/Browser Forum lifetime rules.

ACME Client Configuration

Most ACME clients support multiple CA endpoints:

• cert-manager — Multiple ClusterIssuers, one per CA. Certificate resources can specify preferred issuer with fallback
• Certbot — --server flag to specify CA endpoint. Scripted failover possible
• acme.sh — Native multi-CA support with --server and automatic fallback
• Caddy — Built-in ACME with configurable CA and automatic fallback to ZeroSSL

Available ACME CAs

• Let's Encrypt — Free, most popular, 90-day certificates (already shorter than Forum maximum)
• ZeroSSL — Free tier + paid plans, ACME support, REST API alternative
• Google Trust Services — Free ACME, backed by Google's root program
• Buypass — Norwegian CA, free ACME, GDPR-friendly
• DigiCert / Sectigo / GlobalSign — Commercial CAs with ACME support for enterprise accounts

The Resilience Test

Simulate a primary CA outage: block access to the primary CA endpoint and verify that your automation fails over to the backup CA, issues a valid certificate, deploys it successfully, and alerts your team. Run this test quarterly. If it doesn't work in a drill, it won't work in a real outage.