PKI modernization is now a machine identity governance problem

At a glance

What this is: This is a Keyfactor article arguing that PKI modernization has shifted from infrastructure maintenance to machine identity governance because legacy certificate environments cannot keep up with modern workloads, ownership, and automation needs.

Why it matters: It matters because PKI, certificate, and machine identity sprawl now affects governance, lifecycle control, and service reliability across NHI, cloud, and DevOps programmes.

By the numbers:

• According to Keyfactor, only 47% of companies have enough staff dedicated to their PKI.
• According to Keyfactor, root CA certificates can have a lifespan of up to 25 years.
• According to Keyfactor, some customers achieved a 95% reduction in PKI infrastructure costs.

Context

PKI modernization is the process of updating certificate infrastructure so it can support modern identity and trust requirements across cloud workloads, IoT devices, DevOps pipelines, and machine identities. The issue is no longer whether certificates can be issued, but whether they can be governed consistently across environments that change faster than legacy CA designs were built to handle.

Legacy PKI often fails because it was designed for a narrow set of internal applications, not for distributed certificate demand, API-driven workflows, or hybrid deployment models. In identity terms, the control problem is lifecycle governance: ownership, policy consistency, rotation, revocation, and visibility across a growing machine identity estate.

The article also reflects a broader operating reality: when PKI is passed between teams without clear accountability, local fixes create certificate sprawl, shadow CAs, and audit friction. That is an NHI governance issue as much as a platform issue, because the identity objects being governed are certificates, keys, and the systems that depend on them.

Key questions

Q: What breaks when legacy PKI is stretched across modern cloud and remote access use cases?

A: Legacy PKI tends to break in three places: scale, visibility, and operational simplicity. Older certificate authority setups often struggle with multi-cloud integration, distributed device populations, and the need to issue and revoke certificates quickly. When that happens, teams face complexity, slow changes, and a higher chance of outages or unmanaged trust gaps across the environment.

Q: Why does certificate sprawl increase operational risk?

A: Certificate sprawl increases risk because every additional certificate adds another trust object that can expire, duplicate, or go unowned. In distributed environments, sprawl expands the number of places where outages and control failures can start. It also makes manual tracking less reliable, which is why governance must shift from counting certificates to managing their lifecycle.

Q: How should teams decide whether PKI needs modernization?

A: Teams should modernize PKI when certificate volume, renewal frequency, or hybrid complexity outgrows the current operating model. If the organization cannot reliably inventory certificates, enforce policy, and renew without manual intervention, the PKI is already operating beyond its safe governance capacity. Modernization should be driven by continuity risk, not by technology refresh cycles.

Q: What should organizations prioritize first in a PKI modernization programme?

A: They should start with ownership and inventory before technology refresh. If teams do not know which CAs exist, who owns them, and which certificates depend on them, automation will only accelerate unmanaged complexity. The first job is to establish authoritative control over the current trust estate.

Technical breakdown

Why legacy PKI breaks under machine identity sprawl

Legacy PKI platforms were typically designed around a small number of internal trust anchors and manual administration. Once organizations extend certificate use to cloud workloads, containers, IoT devices, DevOps pipelines, and external integrations, the old model fails on scale, not just features. The core technical constraint is that certificate issuance, renewal, and revocation become high-volume, distributed identity operations. If the platform cannot integrate with APIs, orchestration tools, or short-lived workload patterns, teams create workarounds that fragment trust. That fragmentation is what turns PKI into a governance problem rather than a tooling choice.

Practical implication: Map certificate workflows to the machine identities that depend on them and identify where manual handling is creating unmanaged trust paths.

Certificate lifecycle automation and crypto-agility

Modern PKI is not only about issuing certificates faster. It has to automate discovery, renewal, provisioning, and revocation across multiple certificate authorities while remaining adaptable to changing cryptographic standards. Crypto-agility means the infrastructure can absorb new algorithms, CA changes, or trust policy shifts without a complete rebuild. That matters because certificate volumes are rising while lifetimes and operational tolerance for failure are shrinking. A manual certificate estate may look controlled on paper, but in practice it creates hidden expiry risk, inconsistent revocation, and a delayed response when cryptographic requirements change.

Practical implication: Treat lifecycle automation and crypto-agility as core design requirements, not optional optimisation layers.

Why PKI consolidation changes governance

Consolidation is a technical control as much as an administrative one. When different teams operate separate CAs, each one carries its own policy drift, ownership ambiguity, and operational risk profile. A centralized model gives security and platform teams one place to enforce standards, see the certificate estate, and apply consistent controls across environments. The governance benefit is not merely fewer tools. It is fewer untracked trust decisions. For machine identities, that distinction matters because a certificate that exists outside central oversight is still an identity, even if no one has a reliable inventory of it.

Practical implication: Consolidate certificate authorities where possible and require every certificate source to roll up to a governed inventory.

Threat narrative

Attacker objective: The practical objective is not a classic intrusion chain but sustained control of trust paths through unmanaged certificates and fragmented PKI governance.

1. Entry occurs when legacy PKI cannot keep pace with cloud, IoT, and DevOps certificate demand, so teams create local certificate authorities and ad hoc issuance paths.
2. Credential access appears as unmanaged certificates, keys, and renewals accumulate outside central visibility, creating standing trust that is difficult to review or revoke.
3. Escalation happens when fragmented CA ownership and long-lived roots let weak governance persist across environments, increasing outage and audit exposure.
4. Impact is certificate sprawl, inconsistent policy enforcement, and operational failure when expired or misconfigured certificates interrupt services or break trust chains.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

PKI modernization is now a machine identity governance problem: the centre of gravity has moved from certificate issuance to lifecycle control across identities that outnumber human users and change faster than legacy CA processes can follow. This is not just infrastructure refresh. It is governance over certificate ownership, policy consistency, and trust boundaries across cloud, DevOps, and IoT estates, and practitioners should treat PKI as part of NHI operating model design.

Certificate sprawl is the clearest signal that governance has already broken down: when teams spin up local CAs to meet immediate needs, they create shadow trust systems that security cannot reliably inventory or recertify. The article’s staffing gap and long-lived root CA model explain why this happens. The implication is that PKI ownership must be explicit, centralized, and operationally accountable before scale turns into ungoverned fragmentation.

Automation is no longer a convenience layer, it is the control surface: manual renewal, revocation, and discovery are too brittle for modern certificate volumes and short-lived workload patterns. In practice, lifecycle automation becomes the only way to keep certificates visible enough to govern and short-lived enough to trust. Teams that still depend on spreadsheets are already accepting hidden operational risk.

Crypto-agility is the future-state requirement that exposes today’s debt: if an environment cannot adapt to new algorithms or CA changes without rework, it is already locked into legacy assumptions about trust duration and infrastructure stability. That assumption no longer matches hybrid estates or post-quantum transition planning. Practitioners should read modernization as a redesign of trust portability, not a procurement exercise.

Machine identity governance will increasingly look like lifecycle governance across people, services, and platforms: the same programme discipline that applies to joiner-mover-leaver control and access reviews now extends to certificates, issuers, and renewal chains. The organizations that succeed will standardize certificate ownership the same way mature IAM teams standardize account ownership, because unmanaged trust objects become operational liabilities.

From our research library:

• 42% of machine identities have privileged access and 61% of organisations lack identity security controls for cloud workloads, according to CyberArk's 2025 Identity Security Landscape.
• Read next: NHI Lifecycle Management Guide

What this signals

Machine identity governance now sits at the centre of PKI strategy: the practical problem is not whether certificates can be issued, but whether every certificate, issuer, and renewal path is owned, visible, and policy-bound. In large environments, that means PKI must be governed as a lifecycle discipline, not an infrastructure afterthought.

Certificate sprawl is a control-plane issue, not a tooling inconvenience: when teams create their own trust islands, policy drift and hidden dependencies accumulate faster than central teams can reconcile them. That is why consolidation and inventory discipline matter before automation is scaled further.

Crypto-agility is becoming a board-level resilience requirement: environments that cannot change trust algorithms or CA models without disruption are already carrying structural risk into the post-quantum transition. The organisations that prepare now will be able to adapt without rebuilding their trust fabric later.

For practitioners

• Establish a single certificate ownership model Assign a named owner for every CA, certificate policy, and renewal workflow so responsibility does not drift between infrastructure, security, and application teams.
• Inventory shadow CAs and unmanaged certificates Discover certificate authorities created outside central governance, then reconcile them against the authoritative inventory used for policy, renewal, and revocation.
• Automate renewal and revocation workflows Move high-volume certificate operations out of spreadsheets and manual reminders, especially for workloads that issue and rotate certificates continuously.
• Design for crypto-agility now Ensure the certificate platform can support algorithm changes, CA changes, and future post-quantum transitions without forcing a full rebuild.
• Consolidate fragmented CA estates Reduce the number of independent certificate infrastructures and bring disparate environments under one policy and visibility model.

Key takeaways

• Legacy PKI no longer matches the scale and operating model of cloud, IoT, and DevOps-heavy environments.
• The main failure mode is governance fragmentation, where certificate ownership, inventory, and renewal drift outside central control.
• Modernization only reduces risk when it combines lifecycle automation, consolidation, and crypto-agility into one trust model.

Key terms

• PKI modernisation: PKI modernisation is the shift from manual, legacy certificate operations to managed, automated, and more visible certificate governance. It matters because the value is not only lower cost, but tighter control over expiry, ownership, and trust boundaries across the environment.
• Certificate Sprawl: Certificate sprawl is the uncontrolled growth of certificates across systems, services, and environments. It creates operational risk because each certificate becomes another trust object that can expire, duplicate, or remain unowned, making outages and governance failures more likely.
• Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
• Machine identity lifecycle: Machine identity lifecycle is the full governance process for a non-human identity from creation to retirement. It includes provisioning, access scoping, rotation, renewal, offboarding, and auditability, and it fails when any one of those steps is handled manually or inconsistently.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.