NTLM replacement with certificate-based authentication for remote access

At a glance

What this is: This article argues that certificate-based authentication is the practical replacement for NTLM in remote access and SaaS sign-in, with device certificates carrying the trust burden.

Why it matters: IAM teams need to treat certificate lifecycle, device binding, and on-prem-to-cloud authentication flow as one governance problem, not separate implementation tasks.

Context

Microsoft’s NTLM retirement is not only a protocol change. It exposes the gap between legacy Windows authentication patterns and the reality of internet-facing access, where a domain controller may not be reachable and the authentication path must still remain trustworthy.

Certificate-based authentication answers that gap by binding access to device-issued X.509 credentials rather than a challenge-response exchange. For IAM and remote access teams, the practical question is how to extend that trust boundary beyond the LAN without rebuilding the same risk under a different name.

The article also connects this to SaaS single sign-on, where the same certificate model can strengthen identity assurance for cloud applications. That makes the topic relevant across NHI-adjacent certificate lifecycle, workforce access, and federated identity design.

Key questions

Q: What breaks when NTLM is removed from remote access flows?

A: Remote access paths that still depend on NTLM lose a legacy fallback that tolerated internet-facing connections without direct domain controller reachability. The practical failure is not just login disruption. It is a trust-model mismatch between older challenge-response authentication and modern access paths that need stronger device assurance and certificate governance.

Q: Why does certificate-based authentication reduce risk for remote sign-in?

A: It reduces risk because the device proves possession of a private key tied to a trusted certificate, which is harder to replay than legacy challenge-response authentication. That shifts assurance from protocol compatibility to cryptographic device trust, but only if certificate issuance, storage, and revocation are tightly governed.

Q: How should teams govern certificate lifecycle for access control?

A: Teams should treat certificate lifecycle as an identity control, not an infrastructure afterthought. That means defining ownership for enrollment, renewal, revocation, lost-device handling, and replacement so the authentication decision remains trustworthy throughout the certificate’s active life.

Q: What is the difference between device-based certificates and password-based remote access?

A: Password-based remote access relies on user knowledge and often compensating controls such as MFA, while device-based certificates bind the authentication event to a specific trusted device and key pair. The difference matters because certificate trust can strengthen remote assurance, but it also creates lifecycle obligations around issuance, storage, and revocation.

Technical breakdown

Why NTLM breaks down for remote authentication

NTLM is a legacy challenge-response protocol that was designed for a world where the authenticator and the validating infrastructure could both be inside the network boundary. Remote internet access changes that assumption. When the domain controller cannot be reached directly, the protocol may still function through intermediary services, but that convenience comes with outdated security properties and weak fit for modern zero trust designs. The issue is not only that NTLM is old. It is that its trust model was built around network location and implicit compatibility, not device assurance or strong identity binding.

Practical implication: map every remaining NTLM dependency to the remote access path it supports and prioritise the ones that expose the internet boundary.

How certificate-based authentication changes the trust model

Certificate-based authentication uses a public key certificate on the device to prove possession of the corresponding private key. In practice, that means the device becomes part of the authentication evidence, not just the user. This shifts the control from shared protocol trust to device-bound cryptographic trust, which is a better fit for remote access and for scenarios where the identity provider must validate a certificate before allowing sign-in. The strength of the model depends on certificate issuance, storage, revocation, and device trust anchors, not on the login screen itself.

Practical implication: treat certificate issuance and revocation as access control events, not just PKI administration.

Why certificate lifecycle is now the real control plane

CBA only improves security if the certificate lifecycle is controlled end to end. Every device needs a certificate, which creates governance pressure around enrollment, trust store placement, rotation, revocation, and device replacement. If those controls are weak, certificate-based authentication can become a new long-lived trust dependency rather than a cleaner replacement for NTLM. This is why CBA sits close to identity governance and workload-style certificate management even when the subject is human remote access: the authentication method is cryptographic, but the governance problem is lifecycle discipline.

Practical implication: align certificate lifecycle ownership with identity governance so access assurance does not drift after issuance.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

NTLM replacement is really a trust-boundary redesign: The article shows that the problem is not simply swapping one protocol for another. NTLM depended on reachability and legacy compatibility, while certificate-based authentication depends on device trust and certificate governance. That is a materially different control model, and practitioners need to evaluate it as an identity boundary change, not a transport fix.

Certificate-based authentication exposes certificate lifecycle debt: CBA moves security responsibility from password or challenge-response weakness to certificate issuance, storage, revocation, and device replacement. That means the quality of the authentication posture is only as strong as the organisation’s ability to govern those lifecycle events consistently. The practitioner implication is that certificate management becomes part of access governance, not a separate infrastructure task.

Remote access identity now depends on device assurance: The article makes clear that the remote access problem is solved by tying authentication to a trusted device, not just to a user credential. That aligns with zero trust thinking, but it also means remote identity assurance becomes much more sensitive to endpoint trust and certificate handling. Teams should treat device-bound trust as a first-class identity control.

Certificate-based authentication is a governance bridge between human IAM and non-human trust patterns: Although the article is about remote user access, the control logic is similar to NHI lifecycle thinking. A cryptographic identity only remains trustworthy while its certificate state, ownership, and revocation path stay current. That makes this a useful bridge case for IAM leaders who manage both workforce access and machine trust.

NTLM deprecation will force hidden dependency cleanup: Microsoft’s phased removal of NTLM will surface legacy access paths that organisations have tolerated because they were convenient for remote connectivity. The issue is not whether NTLM still works today, but whether the remaining dependency can survive the authentication model shift without exposing remote users to outdated trust assumptions. Practitioners should expect remediation work to move from the perimeter inward.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Certificate lifecycle is becoming access governance: When remote authentication moves from NTLM to client certificates, the security question shifts to who issues, stores, rotates, and revokes those certificates. That is no longer just PKI administration. It is the operational boundary of identity assurance for remote users.

Device-bound trust will expose weak endpoint control: Certificate-based authentication only works as intended when the device that holds the private key is itself trustworthy. Remote access teams should expect endpoint integrity, hardware-backed storage, and revocation handling to become visible failure points in their programme.

Zero trust becomes more concrete when authentication is tied to hardware-backed identity: The article’s model fits the direction many access programmes are already taking. The practical signal is that remote sign-in controls now need to account for certificate state and device trust as much as user identity.

For practitioners

• Inventory NTLM-dependent remote access paths Identify every IIS, RD Gateway, Exchange, VPN-adjacent, and SSO flow that still relies on NTLM for internet-facing authentication. Prioritise the paths that cannot reach a domain controller directly and map the applications, user groups, and network segments they support.
• Define certificate issuance and revocation ownership Assign clear ownership for certificate enrollment, rotation, revocation, and replacement so authentication assurance does not depend on ad hoc infrastructure handling. Include device replacement and lost-device scenarios in the lifecycle owner’s scope.
• Bind remote authentication to device trust Require device-issued certificates stored in trusted hardware or equivalent protected storage for remote connections that replace NTLM. Make certificate validation part of the sign-in decision rather than a back-end assumption.
• Extend on-prem policy into SaaS sign-in If on-prem AD policies already govern local logins, evaluate whether the same assurance level can be extended to cloud applications through certificate-backed SSO so remote and local access are governed consistently.

Key takeaways

• NTLM’s removal forces remote access programmes to move from legacy challenge-response trust to certificate-bound identity assurance.
• The main operational burden shifts to certificate enrollment, storage, renewal, revocation, and device replacement.
• Teams that keep certificate governance separate from access governance will recreate the same hidden risk under a newer authentication method.

Key terms

• Certificate-based authentication: A method of proving identity using a cryptographic certificate and the associated private key rather than a reusable password. In identity programmes, it raises the bar for theft and replay because the secret is bound to lifecycle, issuance, and revocation control.
• Client Certificate Authentication: A method of proving a device or user possesses a trusted private key and certificate during connection setup. In identity programmes, it functions as an authentication credential, but its security depends on how tightly issuance, storage, renewal, and revocation are governed across the endpoint lifecycle.
• Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
• Remote Access Identity: Remote access identity is the control layer that governs how users prove who they are when connecting from outside the local network. It combines user authentication, device trust, and policy enforcement, and it fails when organisations rely on protocols that only worked because the network boundary did the heavy lifting.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.