TL;DR: Government agencies are under pressure to secure digital identities, encrypt communications, and manage certificates at scale, and managed PKI centralises issuance, renewal, revocation, and key handling to reduce operational burden, according to eMudhra. The governance issue is not convenience but control ownership, because certificate lifecycle failures still become identity and data protection failures.
At a glance
What this is: Managed PKI is presented as a way for government agencies to centralise certificate lifecycle control and reduce the strain of running PKI in-house.
Why it matters: It matters because certificate governance sits inside broader IAM, NHI, and data protection programmes, and weak lifecycle control turns trusted digital identities into operational and compliance risk.
Context
Managed PKI is a service model for issuing, renewing, revoking, and storing certificate-related credentials under a central operating model. In government, that matters because certificates are not just technical artefacts, they are identity bindings that support secure communications, service authentication, and data protection across citizen-facing and internal systems.
The problem the article addresses is governance, not just administration. When agencies keep PKI in-house, they also inherit the responsibility for key handling, certificate lifecycle accuracy, revocation speed, and compliance evidence, all of which become harder as the environment grows and legacy systems remain in service.
Key questions
Q: What goes wrong when certificate lifecycle is not operationally owned?
A: When no team owns certificate lifecycle, expiry, revocation, and replacement become ad hoc troubleshooting tasks instead of controlled processes. That creates access interruptions, inconsistent trust decisions, and hidden exceptions. In practice, the failure is usually not the certificate mechanism itself but the absence of accountable lifecycle management around it.
Q: Why do managed PKI programmes still need strong governance?
A: Managed PKI removes some operational burden, but it does not remove accountability for trust decisions. Agencies still need to define certificate scope, approve issuance rules, monitor revocation status, and prove who can handle private keys. Without that governance, the provider may run the service while the agency still owns the risk.
Q: What are the signs that certificate revocation is not working properly?
A: Common signs include certificates remaining trusted after compromise, redundant certificates staying active, delayed updates to certificate status, and inconsistent results between revocation lists and online status checks. Another warning is when teams cannot quickly remove or invalidate certificates tied to changed identities. These symptoms show that revocation is not keeping pace with operational reality.
Q: Should organisations centralise PKI governance or keep it local to teams?
A: Centralisation usually improves visibility, policy consistency and auditability, but only if local teams still retain clear responsibility for the systems that consume certificates. The best model is central policy with distributed operational ownership, so the trust fabric is governed once and implemented where the certificates actually run.
Technical breakdown
How certificate lifecycle control changes in managed PKI
Managed PKI changes the operating model by shifting issuance, renewal, revocation, and status checking into a centrally run service. That does not change the cryptographic mechanics of PKI, which still depends on public/private key pairs and certificate authorities, but it changes who carries the burden of keeping the certificate estate current. In practice, lifecycle control is the control plane for trust. If renewal, revocation, or enrolment drifts, the certificate may still validate technically while the governance process has already failed.
Practical implication: Treat certificate lifecycle management as an identity governance control, not just an operations task.
Why key management is the real control boundary
PKI security depends on protecting private keys, because the public key can be widely distributed without reducing trust. Managed key handling typically covers generation, storage, escrow, rotation, and recovery, which are the points where compromise becomes durable. For government agencies, the security question is not whether a certificate exists, but whether the underlying key is still controlled across its full lifecycle. That is why certificate governance and key governance cannot be separated in practice.
Practical implication: Map private key custody, recovery, and rotation to explicit ownership and audit requirements.
Why revocation speed matters in public-sector identity
Revocation is the mechanism that stops a certificate from continuing to authenticate after it is no longer trustworthy. The article’s emphasis on CRLs and OCSP reflects a simple reality: certificate compromise or policy change is only contained when relying parties can check status reliably. In government networks, slow revocation turns a trusted identity into a lingering access path. That is a governance failure because the identity remains valid longer than the trust decision that created it.
Practical implication: Verify that revocation checking works across all systems that consume certificates, including legacy applications.
Breaches seen in the wild
- Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
- Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Managed PKI is really certificate governance with a service wrapper: The operational burden moves, but the governance burden does not disappear. Government agencies still own identity proofing quality, certificate scope, revocation policy, and the trust decision that binds a certificate to a service, device, or person. The practical conclusion is that managed PKI should be assessed as a control model, not as a convenience purchase.
Certificate lifecycle failures are identity failures, not just infrastructure failures: When renewal, revocation, or private-key handling slips, the result is often continued authentication by an identity that should no longer be trusted. That makes managed PKI relevant to both IAM and NHI governance, because certificates increasingly secure workloads, services, and machine-to-machine communications. Practitioners should treat certificate state as part of identity inventory, not a separate technical silo.
Private key custody is the control boundary that determines trust durability: If the organisation cannot explain who can generate, store, recover, and retire the key, it does not truly control the certificate. Managed PKI can improve consistency, but it also creates a hard dependency on provider processes, monitoring, and evidence. The implication is clear: agencies must be able to audit the lifecycle, not just consume the service.
Public-sector certificate sprawl creates hidden governance debt: The more systems that rely on certificates, the more likely it is that legacy applications, internal services, and external integrations will drift out of policy. That is why managed PKI should be aligned to identity inventory, service ownership, and offboarding processes. The practitioner conclusion is to govern certificates as an estate, not as isolated technical objects.
Managed PKI exposes a broader identity architecture question: Government programmes that centralise certificate operations still need clear boundaries between human identity, workload identity, and service credentials. Without that separation, certificate governance becomes a catch-all for every trust problem in the estate. The implication for practitioners is to define which identities PKI is meant to govern and which controls sit around it.
From our research library:
- According to a recent Gartner report, 40% of government organizations are expected to establish dedicated trust operations functions by 2028 to combat deepfakes.
What this signals
Certificate governance is now part of identity governance: Government agencies should not treat certificates as a separate infrastructure topic. When certificates authenticate services, devices, and internal applications, lifecycle mistakes become access-control mistakes, so the governance model has to include ownership, revocation, and offboarding.
Managed PKI can reduce operational friction, but it also makes dependency boundaries more important. Agencies need to know which parts of the certificate lifecycle are externally run and which remain internal policy decisions, otherwise accountability becomes unclear when trust decisions fail.
For practitioners
- Define certificate ownership by system and service Create an inventory that maps each certificate to a named business service, technical owner, and renewal path so no certificate is orphaned.
- Separate key custody from certificate administration Document who can generate, store, recover, and retire private keys, and require evidence for each lifecycle step.
- Test revocation checking across all consuming systems Validate that CRLs and OCSP are actually enforced by applications, gateways, and legacy systems before a compromise forces the issue.
- Align managed PKI to identity governance processes Fold certificate issuance and revocation into joiner-mover-leaver, service onboarding, and offboarding workflows so trust does not outlive ownership.
- Require audit evidence from the provider Ask for operational logs, status reporting, and change records that prove the provider can support compliance evidence for certificate lifecycle controls.
Key takeaways
- Managed PKI changes who runs certificate operations, but it does not change who remains accountable for trust decisions.
- Certificate lifecycle failures affect authentication, data protection, and auditability, so they belong in identity governance rather than isolated infrastructure management.
- Government agencies should inventory certificate ownership, key custody, and revocation enforcement together if they want managed PKI to reduce risk rather than move it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Certificate revocation and retirement are the offboarding controls in this managed PKI discussion. |
| NHI-07 — Long-Lived Secrets | Private keys and certificates become risky when they persist beyond their intended trust window. | |
| Recommendation — Tie certificate retirement to offboarding workflows so trust does not outlive ownership. Shorten certificate and key lifetimes where possible and track stale credentials for retirement. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | PKI certificate and key lifecycle governance maps directly to authenticator management. |
| Recommendation — Apply IA-5 to govern issuance, rotation, storage, and revocation of certificate authenticators. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificates here function as access-bound authenticators that must be governed as entitlements. |
| Recommendation — Review certificate-based entitlements as part of access authorization and revocation processes. | ||
| CIS Controls v8 | CIS-5 — Account Management | Managed PKI requires lifecycle control over identities that authenticate systems and services. |
| Recommendation — Maintain an authoritative inventory of certificate-backed identities and remove stale access paths promptly. | ||
Key terms
- Internal PKI: Internal PKI is the private certificate infrastructure an organisation uses for internal services, workloads, and trusted communications. It often carries more hidden dependency than public TLS because ownership, renewal paths, and exception handling may be less visible and less automated.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Private Key Custody: Private key custody describes where a certificate’s secret key is stored and who can access it. Strong custody keeps keys non-exportable, limits access to the smallest necessary service account set, and avoids storage in code, shared filesystems, or other exposed locations.
- Revocation and Status Checking: Revocation and status checking are controls that confirm whether a digital credential is still valid at the time it is presented. Revocation lets an issuer invalidate a credential early, while status checking lets a verifier confirm current validity. Together they prevent expired or compromised credentials from being trusted.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org