TL;DR: Digital certificates bind identities to public keys, but their security depends on lifecycle discipline, private key protection, and revocation that many programmes still struggle to enforce, according to 1Kosmos. The real risk is not the certificate itself, but the governance gap between issuance, trust, and removal.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on 1Kosmos's blog post: Trust depends on lifecycle governance, not just certificate issuance.
Why it matters: It matters because IAM, PAM, and NHI teams all rely on certificate-backed trust, and weak revocation or private key handling undermines authentication across human and machine identities.
Context
Digital certificates are identity-bound credentials that let a party prove possession of a public key, while PKI defines how those certificates are issued, trusted, renewed, and revoked. The governance gap appears when organisations treat the certificate as the control instead of the certificate lifecycle.
For IAM practitioners, the core issue is trust maintenance across human access, service identities, and workload-to-workload communications. If private keys are exposed or revocation is slow, the certificate still validates while the underlying identity trust has already failed.
Key questions
Q: What breaks when certificate revocation is slow or incomplete?
A: When revocation is slow or incomplete, identities continue to authenticate after they should have been removed from trust. That creates stale access on decommissioned devices, orphaned machines, and former vendor-managed endpoints. The result is residual access that looks legitimate to systems but no longer matches business intent.
Q: Why do AI agents complicate zero trust in identity and access management?
A: Zero trust assumes continuous verification of who or what is requesting access, but AI agents can chain actions, infer context, and reuse privileges in ways traditional sessions do not. That means trust must be checked at the workload, action, and approval levels, not only at login. The result is more granular policy, not weaker security.
Q: How should security teams measure whether certificate governance is actually working?
A: Use operational signals, not policy statements. Track certificate expiry outages, provisioning and revocation latency, support ticket volume, and whether teams can identify all cryptographic assets in use. If a trust programme looks compliant on paper but still produces outages, workarounds or blind spots, governance is not working as intended.
Q: What is the difference between certificate issuance and certificate trust?
A: Issuance is the act of creating and signing a certificate, while trust is the ongoing decision by systems to accept that certificate as valid. A certificate can be issued correctly and still become unsafe later if the private key leaks, the identity changes, or revocation does not propagate.
Technical breakdown
How certificate trust actually works
A digital certificate links an identity to a public key through a certificate authority signature. That signature says the issuing authority has vouched for the binding, not that the identity remains trustworthy forever. PKI is the supporting structure that manages issuance, chain validation, renewal, and revocation. The important technical point is that verification is often point-in-time, while risk changes over the certificate's lifetime. Once the private key is compromised, the certificate can still appear valid until revocation propagates and relying parties stop accepting it.
Practical implication: Treat certificate validation as necessary but insufficient, and measure how quickly compromised credentials are revoked and rejected.
Private key exposure turns a trusted certificate into an impersonation path
The private key is the real secret in the certificate model because anyone who controls it can authenticate as the certificate holder or decrypt protected traffic, depending on use case. That makes private key storage, access, and rotation the decisive control plane. In NHI terms, certificates are only as strong as the secrets that back them. This is why certificate management cannot sit apart from secrets management, device hardening, and privileged access controls around the systems that generate and store keys.
Practical implication: Inventory where private keys live and restrict access to the systems that can export, copy, or sign with them.
Revocation and renewal are governance controls, not administrative chores
Certificate lifecycle work is often mistaken for clerical maintenance, but renewal and revocation are what keep trust aligned with current identity state. A certificate that outlives its intended owner, or one that remains accepted after compromise, extends the attack window. In practice, the weak point is not the cryptography but the operational handoff between issuance, monitoring, and retirement. That is why certificate governance has to be built into identity lifecycle management rather than treated as an isolated PKI task.
Practical implication: Set explicit ownership, expiry review, and revocation triggers for every certificate class in the environment.
Threat narrative
Attacker objective: The attacker seeks to inherit legitimate trust so they can impersonate an identity or intercept protected communications without immediately triggering suspicion.
- Entry occurs when an attacker gains access to a private key, a misissued certificate, or another trusted certificate-backed credential.
- Credential abuse follows when that certificate is used to impersonate the holder, decrypt traffic, or establish trusted connections without further challenge.
- Impact occurs when the attacker maintains trusted access until revocation completes or the certificate expires, allowing session interception, impersonation, or data exposure.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Certificate trust is a lifecycle problem, not a format problem: The certificate itself is only the proof object. The real security boundary is whether issuance, storage, renewal, and revocation keep pace with identity change. Once organisations treat PKI as a one-time setup, they create trust drift that survives long after the original identity state has changed. The practitioner takeaway is to govern certificates as living credentials.
Private key protection is the decisive control because it governs who can speak with authority: A valid certificate with an exposed private key is indistinguishable from the legitimate holder to relying systems. That means the trust model depends on secret handling, not just certificate policy. For NHI programmes, this is the same pattern seen in API keys and service account credentials, where possession controls identity.
Revocation latency creates identity blast radius: The longer a compromised or misissued certificate remains accepted, the longer an attacker can preserve trusted access. This is a governance failure in the revocation path, not a cryptographic failure in the certificate itself. The field should measure the time between compromise, revocation action, and enforcement across all relying parties.
Digital certificates are a foundational NHI control because they sit on the boundary between identity proof and machine trust: In workloads, services, and automation, certificates often become the machine identity itself. That makes PKI governance a core part of NHI stewardship, not a narrow infrastructure concern. The practitioner conclusion is simple: if certificates are identity, then certificate lifecycle is identity lifecycle.
Identity trust debt accumulates when certificates are allowed to outlive the conditions that justified them: Static issuance assumptions do not fit dynamic environments where services rotate, workloads scale, and systems are rebuilt frequently. That assumption gap is where governance weakens first. The implication is to treat certificate issuance, ownership, and retirement as continuously reconciled controls.
From our research library:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
What this signals
Certificate lifecycle governance is now a shared control problem across human IAM and machine identity: The same trust model that verifies a person during authentication also underpins workload and service communications when certificates are used as identity proofs. That means renewal, revocation, and ownership tracking need to sit inside the identity programme, not beside it.
Private key custody is the control that determines whether the certificate model holds: If the key can be copied, exported, or reused without tight governance, the certificate becomes a reusable impersonation artifact. The practical implication is that teams should treat certificate-backed trust as a secrets management issue as much as a PKI issue.
For practitioners
- Map certificate ownership across all environments Assign a named owner for every certificate class, including TLS, code signing, and internal service certificates, so renewal and revocation do not depend on tribal knowledge.
- Shorten the revocation path Test how long it takes from compromise detection to revocation enforcement across browsers, services, and internal applications, then close the slowest enforcement gap.
- Protect private keys as high-value secrets Store keys in controlled systems, limit export capability, and review which administrators or automation jobs can access signing material.
- Tie certificate renewal to identity lifecycle Synchronise certificate renewal and retirement with workload, application, and service offboarding so trust does not persist after the identity should have been removed.
Key takeaways
- Digital certificates are still a core identity trust mechanism, but their value depends on lifecycle governance and private key protection.
- The main failure mode is not weak cryptography but trust drift, where issuance, renewal, and revocation fall behind identity change.
- Teams should tie certificate management to ownership, secret handling, and offboarding so trust ends when the identity should end.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Certificates are the authentication mechanism discussed, and key compromise breaks that trust. |
| NHI-07 — Long-Lived Secrets | The article stresses renewal and revocation because stale certificates and keys outlive their trust value. | |
| NHI-01 — Improper Offboarding | Certificates must be revoked when the identity or workload they represent is removed. | |
| Recommendation — Apply NHI-04 controls to harden certificate-backed authentication and prevent reuse after compromise. Use NHI-07 to enforce expiry, renewal, and timely retirement of certificate-backed credentials. Apply NHI-01 to revoke certificates when services, workloads, or users are decommissioned. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate renewal, replacement, and revocation are authenticator lifecycle controls. |
| Recommendation — Use IA-5 to manage certificate issuance, rotation, and revocation as controlled authenticators. | ||
| MITRE ATT&CK | TA0006 — Credential Access | A stolen private key or certificate enables credential access and impersonation. |
| Recommendation — Map exposed certificates to TA0006 and prioritise monitoring for key theft and reuse. | ||
Key terms
- Digital certificate: A cryptographic credential issued for a defined period that can be used to prove identity during authentication. It supports stronger, time-bound access control, but only when issuance, renewal, and revocation are managed as part of the identity lifecycle.
- Public Key Infrastructure: Public Key Infrastructure is the trust system that issues, manages, and revokes digital certificates used to prove identity. In practice it binds keys to entities and policies, making authentication, encryption, and non-repudiation possible across users, devices, and services.
- Private Key: A private key is the secret half of an asymmetric cryptographic pair used to prove identity or sign data. In operational environments it can authenticate services, sign tokens, or decrypt traffic, which makes exposure a trust failure, not just a confidentiality issue.
- Certificate Revocation List: A Certificate Revocation List is a signed publication from a certificate authority that lists certificates that are no longer trusted before their natural expiry. It is used by relying systems to confirm current status, and it becomes operationally useful only when the list is reachable, current, and readable by the consuming toolchain.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org