TL;DR: Automation is increasingly being used by cybercriminals to improve phishing and other scams, while the same pattern is now being applied to PKI certificate management to reduce manual error, improve scalability, and support compliance, according to GlobalSign. The underlying issue is not automation itself but whether certificate and identity processes can remain visible, governed, and revocable when lifecycles move faster than spreadsheets and manual checks can track.
At a glance
What this is: This is a GlobalSign perspective on automating PKI certificate management, arguing that automation improves efficiency and compliance while reducing the governance fragility of manual certificate tracking.
Why it matters: It matters because certificate lifecycle control is identity control for workloads, applications, and secure communications, and manual inventory methods break down as environments scale.
Context
PKI certificate management is the operational discipline of issuing, tracking, renewing, and revoking certificates that underpin trust for browsers, devices, email, and code. The governance gap is not a lack of cryptography, but the mismatch between certificate lifecycles and manual tracking methods that cannot keep pace with change.
GlobalSign's article frames automation as a response to both attacker speed and defensive scale. For IAM and NHI practitioners, the practical issue is whether certificate inventory, ownership, renewal, and revocation remain visible enough to govern when the environment changes faster than human review cycles.
Key questions
Q: How should organisations automate certificate renewal without losing control?
A: Automate the predictable parts of renewal, especially for low-risk certificates with repeatable trust paths, and keep human review for exceptions and high-impact systems. The goal is not to remove governance, but to move it earlier and make it explicit in workflow design instead of depending on manual follow-up.
Q: Why do spreadsheet-based certificate processes fail in modern PKI environments?
A: Spreadsheet-based processes fail because certificate lifecycles are too dynamic for manual tracking to stay current. Certificates expire, ownership changes, and trust relationships shift faster than human reconciliation can keep up. That creates predictable blind spots where outages, exposure, and missed revocation decisions become more likely.
Q: What breaks when certificate ownership is not mapped to identities?
A: Ownership gaps break accountability, renewal coordination, and change planning. If a certificate, key, or API credential has no clear identity owner, teams often miss expiration events, fail to coordinate replacement, or overlook dependent systems that will fail when cryptography changes.
Q: What is the difference between certificate automation and certificate governance?
A: Certificate automation executes issuance, renewal, and revocation workflows. Certificate governance defines who owns the certificate, which systems are allowed to use it, when it must be rotated or removed, and how exceptions are approved. Automation without governance is only faster administration, while governance gives the automation clear boundaries.
Technical breakdown
Why manual certificate inventory fails at scale
Certificate management breaks down when ownership, renewal dates, and revocation status live in spreadsheets or disconnected tickets. PKI certificates are time-bounded trust artefacts, so even a small lapse can create service disruption or expose authentication paths. Automation matters because it centralises state, reduces reliance on memory, and keeps certificate lifecycle data current across many systems at once. The article also notes that industry changes, including shorter validity periods, make static tracking methods less realistic. Practical implication: treat certificate inventory as a governed lifecycle record, not a side task.
Practical implication: move certificate ownership and expiry tracking into a controlled workflow rather than a static spreadsheet.
How automation changes certificate renewal and revocation
Automation changes PKI from periodic manual maintenance to event-driven lifecycle control. Renewal can be triggered before expiry, revocation can be tied to ownership change or personnel departure, and visibility can be maintained across the certificate estate. That does not remove governance requirements, because automated issuance without inventory discipline can still produce orphaned trust paths. The operational question is whether the certificate process is observable enough to prove who owns each certificate and when it should be retired. Practical implication: tie renewal and revocation to authoritative identity and asset records.
Practical implication: connect renewal and revocation workflows to authoritative identity and asset records.
Why certificate automation is also an identity governance issue
PKI certificates are not just technical artefacts. They are identity-bound trust credentials that prove something about a service, device, application, or user. That makes certificate automation part of identity governance, especially when teams need to manage non-human identities across browsers, IoT devices, email, and code signing. The article's emphasis on compliance and reduced human error is important, but the deeper point is governance continuity: certificate control must survive staffing changes and process churn. Practical implication: govern certificates as part of the NHI and workload identity estate, not as isolated infrastructure tooling.
Practical implication: include certificates in your NHI and workload identity governance model.
Threat narrative
Attacker objective: The objective is to gain trusted-looking access or credibility quickly enough to support fraud, phishing, or disruption before defenders can react.
- Entry occurs when attackers or fraudulent operators exploit fast-moving certificate or phishing workflows to create trusted-looking infrastructure at speed.
- Credential access or trust abuse follows when a certificate process lacks visibility, allowing malicious use of seemingly legitimate trust material.
- Impact lands in the form of phishing, service disruption, or exposure created by certificate expiry and weak lifecycle governance.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Automation does not remove PKI governance debt, it exposes it. The article is right to separate automation from security outcomes. In PKI, automating issuance and renewal only helps if ownership, inventory, and revocation remain authoritative, otherwise the environment simply becomes faster at reproducing the same blind spots. The practitioner conclusion is that automation must be paired with a governed certificate lifecycle, not used as a substitute for one.
PKI certificate management is part of non-human identity governance. Certificates authenticate services, devices, code, and other machine-facing trust relationships, so they belong in the same governance conversation as service accounts and workload identity. When teams treat certificates as infrastructure plumbing, they miss the access control and revocation implications that define NHI risk. The practitioner conclusion is to manage certificates as governed identity credentials, not isolated technical assets.
Shorter certificate lifetimes make manual control increasingly non-viable. The article points to reduced validity periods and market change as reasons spreadsheets no longer hold up. That is not just an efficiency problem, it is a control problem: when lifecycle speed exceeds human tracking, expiry and revocation failures become predictable. The practitioner conclusion is that certificate governance must become system-enforced before lifecycle compression turns routine maintenance into exposure.
Trusted automation is the real design goal, not more automation. The field needs to distinguish between automating a broken process and automating a controlled one. GlobalSign's framing shows why organizations must first establish certificate ownership, central visibility, and change accountability, then automate around those controls. The practitioner conclusion is to validate governance prerequisites before scaling certificate automation across the estate.
What this signals
Certificate lifecycle speed is now the governance pressure point. As validity windows tighten and environments change faster, the old assumption that a human team can keep every certificate visible and current no longer holds. Practitioners should expect more pressure to move certificate control into authoritative lifecycle systems rather than leaving it in ad hoc admin workflows.
Identity teams need to treat certificates as part of the non-human identity estate. That means ownership, renewal, and revocation should be governed alongside workload identity and other machine credentials. If certificates stay outside the identity model, organisations will keep confusing infrastructure convenience with trust control.
For practitioners
- Establish a single certificate inventory Create one authoritative record for all certificates, including owner, system, expiry date, renewal path, and revocation authority. Eliminate spreadsheet-only tracking for certificates that support production trust.
- Automate renewal before expiry thresholds Define lifecycle thresholds that trigger renewal workflows early enough to prevent service disruption and avoid last-minute manual exceptions. Use policy-based renewal for recurring certificate types.
- Link certificate revocation to identity change Ensure certificate revocation is triggered when an owner leaves, a service is decommissioned, or a trust relationship changes. Revocation should be tied to authoritative identity and asset events, not ad hoc cleanup.
- Classify certificates as governed trust credentials Bring certificates into NHI and workload identity governance reporting so security, platform, and PKI teams share the same lifecycle view. This makes ownership gaps and stale trust paths visible to recertification and audit processes.
Key takeaways
- PKI automation reduces manual error, but it does not solve governance on its own.
- Certificate lifecycle control is the practical issue because trust credentials expire, move, and get revoked faster than spreadsheets can track.
- Teams should centralise inventory, automate renewal, and tie revocation to authoritative identity and asset events.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Certificate lifetimes and renewal discipline are the article's central operational concern. |
| NHI-01 — Improper Offboarding | The article notes certificate exposure when experienced staff leave and processes are not transferred cleanly. | |
| Recommendation — Shorten renewal exposure by automating certificate lifecycle controls before expiry becomes service risk. Revoke and reassign certificates when ownership changes or staff exit to prevent orphaned trust paths. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificates function as authenticators that require lifecycle governance and controlled renewal. |
| Recommendation — Apply IA-5 to govern certificate issuance, renewal, and revocation as part of authenticator management. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificate authority and usage permissions are an access-control problem as much as a crypto problem. |
| Recommendation — Use PR.AA-05 to align certificate permissions and trust relationships with approved access scope. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The article links automation-driven abuse to phishing and operational disruption outcomes. |
| Recommendation — Map certificate abuse to TA0006 and TA0040 to prioritise detection of trust-material misuse and disruption paths. | ||
Key terms
- Public Key Infrastructure: Public Key Infrastructure is the trust system that issues, manages, and revokes digital certificates used to prove identity. In practice it binds keys to entities and policies, making authentication, encryption, and non-repudiation possible across users, devices, and services.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Certificate Inventory: A certificate inventory is the authoritative list of all certificates in use across an environment, including owner, expiry, issuing authority, and deployment location. It is the control foundation for monitoring and renewal because teams cannot govern what they cannot reliably enumerate.
- Workload Identity: The identity assigned to a software workload, such as a containerised application, serverless function, or microservice, enabling it to authenticate to other services without storing static credentials.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org