Certificate rotation is the scheduled replacement of cryptographic certificates before they expire or become a security risk. A certificate proves identity in systems that rely on public-key cryptography, such as software update services, TLS connections, code signing, and internal authentication. Rotating certificates refreshes trust material and reduces the impact of key exposure, algorithm changes, and aging infrastructure.
In cyber security, certificate rotation matters because expired or untrusted certificates can break access to services, block updates, or cause clients to reject legitimate software. Defenders use automation, inventory, and overlap periods so old and new certificates work together during migration. Attackers may try to exploit poor rotation by waiting for expired certificates, abusing neglected systems, or inserting rogue certificates into weak trust chains. Good rotation practice keeps trust systems current and helps ensure that security tools, patching pipelines, and encrypted communications continue to function safely.