PKI is becoming the control plane for connected vehicle trust

At a glance

What this is: Connected vehicle security is shifting toward PKI as the control plane for identity, message trust, and software-update integrity.

Why it matters: For automotive identity and security teams, PKI governance now sits at the centre of vehicle trust, V2X assurance, and secure OTA operations.

By the numbers:

• The automotive cybersecurity market is valued at USD 3.31 billion in 2024 and is projected to reach USD 21.44 billion by 2035.
• UNECE Regulations 155 and 156 now require manufacturers to implement secure certificate-based authentication.

Context

Connected vehicle security means treating the car, its software, and its roadside interactions as a governed trust environment rather than a one-time hardware asset. As vehicles exchange data with infrastructure, other vehicles, and cloud services, identity assurance and signed update integrity become operational requirements, not optional enhancements.

This article sits squarely at the intersection of automotive cybersecurity and identity governance. The practical issue is certificate lifecycle control at scale, because V2X messaging, OTA updates, and regulatory obligations all depend on trusted issuance, renewal, and revocation across fleets and suppliers.

Key questions

Q: What breaks when connected vehicle certificates are not centrally governed?

A: The trust chain breaks first. Vehicles, roadside units, and update services can no longer reliably distinguish legitimate identities from spoofed or compromised ones, which weakens V2X message assurance and OTA integrity. The operational result is not just administrative sprawl but a larger window for malicious communication, unsafe updates, and slow revocation during incident response.

Q: Why does certificate failure create safety risk in connected vehicles?

A: Because automotive trust is tied directly to software execution and safety-critical messaging. If a vehicle cannot verify who sent a message or whether an update is authentic, it may accept spoofed V2X traffic or install untrusted code. In this environment, certificate governance is part of safety engineering, not just cybersecurity hygiene.

Q: What are the signs that automotive PKI is failing in a smart car environment?

A: Common warning signs include unmanaged keys, certificates that cannot be renewed or revoked at the device level, inconsistent trust across ECUs, and weak handling of low-power embedded devices. If certificates are not centrally governed through certificate lifecycle management, the security model becomes hard to audit and easy to bypass. That usually shows up as brittle connectivity and growing exposure to spoofing or tampering.

Q: How should manufacturers handle certificate trust across OEM, supplier, and infrastructure domains?

A: They should treat it as a shared governance problem with clear ownership for issuance, revocation, and audit evidence. The certificate model has to work across suppliers, vehicle platforms, and regional credential systems, otherwise trust continuity breaks at the exact points where fleets need consistent assurance.

Technical breakdown

Why PKI becomes the vehicle trust layer

Public Key Infrastructure gives connected vehicles a cryptographic identity that other systems can verify. In a V2X environment, each vehicle or roadside unit needs a certificate that proves it is an authorised participant, and that certificate anchors trust for signed messages, update validation, and device-to-cloud authentication. The architecture only works if issuance, renewal, revocation, and chain validation are reliable across the full operational lifetime of the asset. In automotive settings, that lifecycle is complicated by scale, supplier handoffs, and regional interoperability.

Practical implication: Treat certificate lifecycle governance as part of the vehicle trust architecture, not as a back-office crypto task.

How certificate management supports V2X and OTA security

V2X messaging and OTA update flows use PKI in different but related ways. V2X certificates help receivers decide whether a safety-critical message came from a legitimate vehicle or infrastructure component, while OTA signatures let the vehicle verify that software really came from an authorised source before installation. This prevents spoofed traffic, malicious firmware, and rollback to vulnerable versions. The technical burden is not just signing, but keeping the trust chain intact when certificates expire, are revoked, or must be reissued across many fleets at once.

Practical implication: Build certificate operations to support both real-time message trust and update integrity, with revocation handling that scales.

Why automotive PKI is a supply-chain problem as much as a vehicle problem

Automotive PKI spans manufacturers, suppliers, certificate authorities, roadside infrastructure, and regional credential systems. That means trust can fail at any point in the chain, including provisioning errors, inconsistent regional controls, or weak revocation processes when an issue affects a large population of vehicles. Standards such as IEEE 1609.2 and regional SCMS or CCMS models exist because the trust problem is distributed, not local to the vehicle itself. The operational challenge is maintaining identity continuity when components are built, shipped, updated, and retired across multiple jurisdictions.

Practical implication: Govern certificate issuance and revocation as a cross-supply-chain control, not as a single-platform function.

Threat narrative

Attacker objective: The attacker wants to impersonate a trusted vehicle or infrastructure component, or deliver malicious software into fleet systems.

1. Entry occurs when an attacker targets connected vehicle communications or the OTA update path rather than the car itself, exploiting trust in signed messages or update workflows.
2. Credential or certificate abuse follows when a malicious or spoofed identity is accepted as legitimate because certificate validation, issuance, or revocation controls are weak.
3. Impact lands in vehicle systems when untrusted V2X messages or malicious software updates are allowed to influence safety-critical functions or fleet integrity.

Breaches seen in the wild

• Nissan source code leak 2021: A Nissan North America Git server left on the default admin/admin login was used to copy and leak about 20GB of source code.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Certificate lifecycle is the real control plane in connected vehicles: once vehicles exchange safety-critical messages and install software continuously, the certificate estate becomes the practical boundary for trust. Identity in automotive systems is no longer confined to drivers or staff; it extends to cars, roadside units, update servers, and supplier services. Practitioners should treat issuance, renewal, and revocation as operational security processes, not as periodic administration.

Connected vehicle PKI is a supply-chain governance problem, not just a cryptography problem: automotive trust spans OEMs, Tier 1 suppliers, regional credential systems, and infrastructure operators. That means a single weak link can disrupt message authenticity or update integrity across many assets. The field now needs lifecycle governance that can withstand multi-party issuance and cross-border scale.

UNECE WP.29 turns certificate trust into a compliance obligation: the article reflects a wider shift where secure update mechanisms and cybersecurity management systems are no longer optional design choices. This validates the move from ad hoc certificate handling to governed trust operations. Practitioners should align PKI processes with compliance evidence, not just security intent.

Automotive identity is expanding faster than traditional IAM models were built to handle: millions of vehicles and infrastructure components cannot be governed with manual certificate oversight. The named concept here is vehicular trust sprawl, where identities, certificates, and update authorities multiply faster than the organisation’s ability to inventory and revoke them. The answer is disciplined lifecycle control across the full ecosystem.

Connected mobility teams need to think in terms of trust continuity: the failure mode is not only compromise, but trust loss through expiration, revocation delay, or inconsistent regional policy. That is where automotive PKI either preserves safe operation or becomes the weak point that adversaries exploit. Practitioners should design for continuous verification across the vehicle lifecycle.

From our research library:

• According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.

What this signals

Vehicular trust sprawl: connected mobility expands the number of identities that must be governed, from vehicles and roadside units to update services and supplier systems. The security problem shifts from protecting a few high-value certificates to maintaining continuous lifecycle control across a distributed ecosystem.

Automotive identity programmes should now be evaluated on revocation speed, certificate inventory accuracy, and the ability to prove update authenticity across regions. Those three signals matter more than any single product capability because they determine whether trust can be restored after a compromise or retained during normal operations.

For practitioners

• Govern the full certificate lifecycle Map issuance, renewal, rotation, revocation, and retirement across vehicles, roadside units, and update services so no identity is unmanaged.
• Align V2X credentials with regional standards Validate that V2X credential provisioning and verification paths match IEEE 1609.2 and the relevant SCMS or CCMS operating model in each market.
• Treat OTA signing as a release control Require every software package to be cryptographically signed, verified before installation, and blocked if rollback or chain validation fails.
• Plan for mass revocation events Test how quickly you can revoke and reissue certificates when a supplier issue or compromise affects a large vehicle population.
• Build compliance evidence into PKI operations Capture logs and attestations that show secure update management and certificate-based authentication are enforced across the fleet.

Key takeaways

• Connected vehicles make PKI a core trust control for identity, message authenticity, and secure software updates.
• The article’s central risk is lifecycle failure, not encryption failure, because certificate issuance, renewal, and revocation must work at automotive scale.
• Manufacturers and fleet operators need governance that spans OEMs, suppliers, and regional standards or trust continuity will break under operational pressure.

Key terms

• Vehicle-to-everything: Vehicle-to-everything, or V2X, is the communication model that allows vehicles to exchange data with other vehicles, infrastructure, networks, and related systems. It creates a wider trust boundary because each message depends on identity assurance, certificate validity, and access controls beyond the vehicle itself.
• Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
• Software Update Management System: A Software Update Management System is the governance structure for delivering, validating, and tracking software updates after a vehicle is in service. It helps ensure updates are authorised, traceable, and safe, which is essential when cybersecurity risk changes over time and software becomes part of the compliance posture.
• Security Credential Management System: A Security Credential Management System is the operating model used to provision and manage vehicle credentials in a V2X environment. It exists to make large-scale vehicular trust manageable, especially where many vehicles, roadside units, and authorities must interoperate consistently.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners who need to bring identity discipline to complex operational environments.