TL;DR: PKI remains the trust layer for TLS, device authentication, signed code, and encrypted traffic, but the article argues that most failures come from manual handling, expired certificates, fragmented tooling, and weak lifecycle ownership rather than from cryptography itself, according to GlobalSign. The governance problem is no longer whether PKI works, but whether organisations can operate it as a living identity system instead of a set-and-forget control.
At a glance
What this is: This analysis says PKI is not obsolete, but lifecycle governance failures such as manual certificate handling, poor visibility and weak ownership are what make it break down.
Why it matters: It matters because PKI is now part of the identity fabric for machines, workloads and users, so IAM and NHI teams need governance that treats certificates as managed identities rather than static infrastructure.
Context
PKI is a trust and identity control, not just an encryption mechanism. The article’s core claim is that the technology remains sound, while operational neglect, fragmented ownership and manual certificate handling create the real risk. For identity and security teams, that places certificate lifecycle management in the same governance category as access review, credential rotation and offboarding.
The article also reflects a broader shift in how digital trust is built. Certificates now support device authentication, cloud workloads, signed code and encrypted traffic, which means poor PKI governance can create outages and trust failures across human and non-human identity programmes alike.
Key questions
Q: What breaks when private PKI is deployed without lifecycle governance?
A: Private PKI breaks down when teams do not maintain clear ownership of issuance, trust configuration, renewal, and revocation. The result is hidden dependency sprawl, misconfigured relying systems, and outages when certificates change. The private CA then becomes an operational dependency rather than a trust control.
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable. The turning point is not a specific count, but the moment certificates span teams, tools, and infrastructure layers that no single person can track safely.
Q: What are the signs that PKI governance is failing in a cloud-first organization?
A: Common warning signs include teams using spreadsheets or outdated tools to manage certificates, DevOps groups issuing identities outside security visibility, and inconsistent handling of certificates across environments. If no one can reliably see where certificates live, who issued them, or when they expire, PKI governance is already breaking down and digital trust becomes difficult to maintain.
Q: Who should own certificate risk in DevOps and workload identity programmes?
A: Ownership should sit with the team accountable for the workload and with the identity or security function responsible for policy. If no one owns issuance, renewal, and revocation, certificates become shared infrastructure debt. Clear accountability is essential because machine identities behave like access credentials, not passive configuration objects.
Technical breakdown
Why PKI fails when certificate lifecycle governance is manual
PKI failures usually come from process collapse, not broken cryptography. A certificate is only one part of a larger lifecycle that includes issuance, renewal, revocation, inventory and ownership. When organisations manage that lifecycle through spreadsheets, disconnected tools or ad hoc reminders, expiry becomes inevitable and visibility disappears. The result is not simply a missed renewal but a governance failure: no clear owner, no reliable inventory and no enforceable policy path from issuance to retirement. In identity terms, certificates behave like credentials that need continuous administration, not one-time setup.
Practical implication: Treat certificate lifecycle management as an identity governance control with explicit ownership, inventory and renewal policy enforcement.
How automation changes PKI for cloud, IoT and machine identity
Automation turns PKI from a periodic administrative task into a runtime trust service. In cloud and IoT environments, certificates must be issued and refreshed at machine speed, because workloads, devices and services are far more dynamic than legacy infrastructure. API-driven PKI and policy-based renewal reduce human dependency and make short-lived certificates practical at scale. That matters because machine identities now outnumber humans in most modern environments, and their trust relationships are too numerous for manual handling to keep up. PKI becomes sustainable only when it is integrated into deployment pipelines and orchestration flows.
Practical implication: Build certificate issuance and renewal into CI/CD and orchestration so machine identity trust can scale without manual intervention.
Why expired certificates are an access and resilience problem, not just an IT nuisance
An expired certificate is not merely a housekeeping issue. It can break secure connections, disrupt device authentication, invalidate signed code and undermine the trust assumptions that services rely on to communicate safely. In environments where certificates also anchor non-human identity, expiry can affect access paths, service availability and compliance evidence at the same time. That makes certificate monitoring a resilience control as much as a security control. The governance gap is that many organisations still treat expiry as an isolated event instead of a predictable lifecycle outcome that should be prevented through policy.
Practical implication: Monitor certificate expiry as a service availability and trust failure signal, not only as an administrative reminder.
Threat narrative
Attacker objective: The objective is to exploit weak certificate governance to interrupt trust, impersonate systems or create outages in environments that depend on PKI.
- Entry occurs when attackers take advantage of exposed, expired or poorly inventoried certificates that still anchor trusted communication paths.
- Credential access follows when certificate material, hardcoded secrets or unmanaged keys are available through weak lifecycle controls and fragmented tooling.
- Impact comes from service disruption, impersonation risk or trust breakdown across systems that still rely on the compromised or expired certificate state.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
PKI lifecycle governance is now an identity governance problem, not a niche certificate task. Certificates increasingly anchor machine authentication, service trust and encrypted traffic, so the control model now overlaps directly with NHI governance and credential lifecycle management. A team that cannot inventory, own and revoke certificates is running a trust layer without lifecycle controls. The practitioner conclusion is that PKI belongs inside identity governance, not outside it.
Manual certificate handling creates a standing trust gap. Spreadsheets, fragmented tooling and isolated admin ownership leave organisations unable to see the full certificate estate or act before expiry. That creates the same structural weakness seen in other identity programmes where inventory is incomplete and lifecycle events depend on humans remembering to act. The practitioner conclusion is to remove any certificate process that still depends on memory or local knowledge.
Certificate sprawl: unmanaged issuance, renewal and revocation across cloud, IoT and application pipelines turns PKI into an invisible risk surface. The article’s most useful insight is that PKI becomes brittle when it is scaled without ownership and policy enforcement. In cloud-native estates, machine identities multiply faster than teams can track them, which is why visibility and automation become governance requirements rather than optimisation choices. The practitioner conclusion is to measure certificate sprawl as an exposure driver, not a hygiene metric.
Expired certificates should be treated as operational trust failures. When a certificate expires, the result can be service interruption, broken authentication and compliance evidence gaps, not just a renewal ticket. That makes PKI governance relevant to resilience, IAM, PAM and audit readiness at the same time. The practitioner conclusion is to manage certificate expiry through policy-backed controls and escalation paths before the trust chain breaks.
Short-lived certificates are only effective when lifecycle ownership is explicit. Automation helps, but it does not solve unclear responsibility, missing inventory or inconsistent policy. The broader market signal is that identity security is moving toward continuous trust operations, where machine identities must be governed with the same discipline as human accounts. The practitioner conclusion is to align PKI operations with identity governance, not treat automation as a substitute for control.
From our research library:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
What this signals
Certificate lifecycle debt is the cleanest way to describe the article’s core warning: PKI breaks when issuance, renewal and revocation drift away from ownership and policy. That debt grows quietly until a renewal failure or trust outage makes it visible, which is why the control must be run like identity governance, not like a background utility.
For practitioners, the question is no longer whether certificates are secure, but whether the organisation can prove who owns them, where they live and when they will be replaced. That is the operational boundary where PKI, NHI governance and resilience all meet.
For practitioners
- Implement a single certificate inventory Create one authoritative inventory for certificates, private keys and issuing authorities so renewal, revocation and ownership are visible across teams.
- Automate renewal and revocation workflows Replace spreadsheet-based renewals with policy-driven automation that renews, replaces or revokes certificates before expiry windows create outages.
- Assign explicit certificate owners Name a business or technical owner for each certificate class, including service, device and application identities, so no certificate sits without accountability.
- Integrate PKI into deployment pipelines Build certificate issuance and refresh into CI/CD and infrastructure orchestration so machine identities are managed where they are created and consumed.
- Monitor expiry as a resilience signal Track expiry dates, renewal failures and certificate drift as operational risk indicators, then escalate them like authentication or availability incidents.
Key takeaways
- PKI problems usually come from governance failure, not from weak cryptography.
- Certificate expiry, fragmented tooling and poor ownership are the real sources of outages and trust loss.
- Treat certificates as managed identities and automate their lifecycle across cloud, IoT and application pipelines.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | The article centres on certificate lifecycles that are left unmanaged until expiry or failure. |
| NHI-02 — Secret Leakage | It highlights hardcoded credentials and unmanaged certificate material as part of the failure pattern. | |
| Recommendation — Map certificate expiry, renewal and revocation to NHI-07 and enforce short-lived, governed credential lifecycles. Scan code, pipelines and admin stores for exposed certificate material and remove any leaked secrets immediately. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate issuance, renewal and revocation are authenticator lifecycle functions covered by IA-5. |
| Recommendation — Apply IA-5 to formalise certificate issuance, rotation and revocation across all production identities. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificates operate as access and trust credentials that need controlled authorization paths. |
| Recommendation — Use PR.AA-05 to govern who can issue, renew and revoke certificate-based access. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The threat pattern described is credential abuse leading to trust failure and outage. |
| Recommendation — Map unmanaged certificate exposure to TA0006 and monitor for impact conditions that follow trust compromise. | ||
Key terms
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Certificate Sprawl: Certificate sprawl is the uncontrolled growth of certificates across systems, services, and environments. It creates operational risk because each certificate becomes another trust object that can expire, duplicate, or remain unowned, making outages and governance failures more likely.
- Authenticator Lifecycle Management: Authenticator lifecycle management is the governance of a credential from issuance to renewal, replacement, and retirement. For human identity programmes, it ensures that keys, smart cards, and certificates stay tied to the right user and are removed when the user, role, or device is no longer trusted.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity lifecycle control to the operational realities of modern security programmes.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org