Start by inventorying the certificate and PKI landscape, then identify the workflows that can be automated first. The goal is to move away from staff-dependent tracking and toward a repeatable organization-wide process. That initial assessment should also reveal which business units, applications, and certificate authorities are in scope so teams can reduce blind spots and plan the next maturity step.
What should teams do first when certificate management is still mostly manual?
Start with a complete inventory of the certificate and PKI landscape, because manual tracking usually fails before teams notice where certificates live, who owns them, and which renewal paths are business-critical. That first pass should identify the workflows that can be automated earliest, so the organisation can move from staff-dependent reminders to a repeatable process with less blind spot risk.
Why inventory comes before automation
Automation is only reliable when teams know the full scope of what they are automating. Certificates often sit across applications, infrastructure, business units, internal and external certificate authorities, and different renewal patterns, so trying to automate first can simply digitise the same gaps that existed in spreadsheets.
The practical value of the initial inventory is not just completeness, but classification. Teams need to separate certificates by ownership, renewal frequency, exposure, and dependency so they can see which items are low-risk candidates for immediate automation and which ones need stronger controls or deeper review. A focused inventory also helps expose duplicate issuance, expired certificate exposure, and unmanaged exceptions.
For certificate lifecycle work, the starting point should be an accurate baseline of what exists, where it is issued from, and how it is renewed. That baseline is what makes it possible to choose sensible tooling, define the first automation targets, and avoid building a renewal process around partial information. The Machine Identity, PKI and Certificate Lifecycle Guide is a useful reference for the lifecycle and automation issues that usually surface once teams move beyond manual tracking.
What a useful first inventory should capture
A good starting inventory should cover the certificate itself, the system it protects, and the process that keeps it valid. In practice that means tracking the subject, issuing CA, expiry date, environment, owner, application dependency, key location, and whether renewal is manual, scripted, or already integrated into a platform. Without those fields, teams usually end up with a list that looks complete but cannot support action.
Teams should also group certificates by operational impact. A test certificate that can be replaced quickly should not drive the same process as a public-facing TLS certificate, a code-signing certificate, or a certificate that supports service-to-service authentication. That distinction helps prioritise automation work where outage risk, trust impact, or dependency complexity is highest.
If the inventory reveals workload or service certificates, it is often worth mapping them against the broader machine identity picture, not treating them as isolated TLS objects. The Guide to SPIFFE and SPIRE helps teams think about workload identity, trust bundles, and attestation as part of the same control problem rather than as a one-off renewal exercise. For a broader identity view that includes certificates, tokens, and service accounts, Ultimate Guide to NHIs is a useful navigation point.
How to choose the first automation candidates
The best first candidates are the certificates with high volume, predictable renewal logic, and low exception rates. Those are the renewals most likely to benefit from repeatable workflow automation because the process can be standardised without waiting on manual judgement every time.
Good candidates usually have clear ownership, a known deployment pattern, and a renewal path that can be verified automatically after issuance. Bad first candidates are the ones with frequent ad hoc changes, undocumented dependencies, or unclear rollback options. If a certificate failure would create a customer-facing outage or interrupt trust across multiple systems, teams should automate cautiously and make validation part of the rollout, not an afterthought.
Teams can also use the inventory to identify where certificate management overlaps with broader key and trust management. Publicly trusted certificate operations often need alignment with external ecosystem requirements, while internal PKI may have more freedom in how it is governed. The CA/Browser Forum is relevant when public trust and issuance rules matter, and RFC 8705: OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens is relevant where certificates are part of authenticated machine-to-machine access.
Risk and Threat Considerations
Manual certificate management creates exposure in two directions: missed renewals that break availability, and missed visibility that leaves old or duplicate certificates in circulation. The longer the process depends on human reminders and spreadsheets, the more likely it is that renewal, revocation, or ownership gaps will persist unnoticed.
Failure mechanism: Teams lose track of where certificates are deployed, so renewal and replacement happen late, inconsistently, or not at all. The same blind spots can also leave stale credentials and unmanaged trust paths in place after systems change.
Impact: The organisation faces avoidable outages, trust failures, emergency remediation, and a weaker ability to prove which certificates are active, owned, and controlled.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-57, NIST SP 800-53 Rev 5, CSA Cloud Controls Matrix and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-57 | Key Management | Certificate lifecycle management is a key lifecycle problem. |
| Recommendation — Define certificate cryptoperiods, rotation triggers, and replacement procedures before automating renewals. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate handling is part of credential lifecycle and renewal control. |
| IA-9 — Identification and Authentication (Non-Organizational Users) | Machine and service certificates authenticate non-human systems. | |
| Recommendation — Track issuance, renewal, and revocation for every certificate authenticator. Apply strong authentication controls to service and workload certificates. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Certificate access and ownership must be governed consistently. |
| Recommendation — Assign certificate ownership and enforce controlled access to issuance and renewal processes. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud certificate inventories and automation intersect with identity governance. |
| Recommendation — Map certificates to owners, environments, and trust boundaries in cloud IAM processes. | ||
| CIS Controls v8 | CIS-5 — Account Management | Certificate ownership and lifecycle management depend on maintaining accurate accountable records. |
| Recommendation — Maintain a current inventory of certificate owners, systems, and renewal responsibilities. | ||
Practitioner Guidance
What to prioritise: Start with the certificates that combine business criticality and renewal complexity, then move outward to lower-impact certificates. That sequence reduces the chance that the first automation effort is spent on low-value systems while major outage risks remain manual.
What to verify: Before trusting any automation plan, verify that the inventory can answer three questions for every certificate: who owns it, where it is deployed, and what replaces it if renewal fails. If any of those answers are missing, the process is still too fragile to automate safely.
Practitioner takeaway: The first maturity step is not renewal automation itself, it is creating a trustworthy inventory and ownership model that makes automation safe, repeatable, and scalable.
Related resources from NHI Mgmt Group
- What do teams get wrong about certificate management when collaboration is spread across many users and functions?
- What should teams do first when preparing to automate certificate management across legacy systems?
- What breaks when certificate lifecycle management is still manual?
- What breaks when certificate management still depends on spreadsheets?
