TL;DR: PKI best practice depends on disciplined public key vs private key management, but Keyfactor argues that scale, manual oversight, and poor lifecycle control still turn certificate and key handling into outage, audit, and breach risk. The real failure is assuming trust can be maintained without automated inventory, revocation, and private key protection.
At a glance
What this is: This is a PKI best-practices post arguing that public key and private key management breaks down at enterprise scale when lifecycle control, inventory, and private key protection are not automated.
Why it matters: IAM, PAM, and NHI teams should treat key and certificate governance as a lifecycle problem, because weak control over non-human trust material can trigger outages, failed audits, and impersonation risk.
Context
Public key infrastructure is the governance layer that binds certificates, encryption, and authentication to trusted identities. In this article, the central problem is not asymmetric cryptography itself, but the operational failure mode that appears when key and certificate handling outgrows manual control.
That matters for identity programmes because certificates, private keys, and related trust material sit at the intersection of machine identity, application authentication, and secure access to services. The article’s core message is that scale changes the control model: what works for a few keys fails when certificates number in the millions.
Key questions
Q: What breaks when private keys are poorly protected in cryptocurrency operations?
A: When private keys are weakly protected, attackers can authorise transactions, drain wallets, and move assets without needing to defeat the blockchain itself. Losses are usually irreversible because ledger entries are designed to be final. That makes key protection, backup discipline, and hardware-based storage core controls, not optional hardening.
Q: Why do certificates create governance problems when they spread across many systems?
A: Certificates create governance problems because trust is easy to issue but hard to track. As certificates spread across cloud, IoT, software release and authentication workflows, organisations often lose sight of who owns them, where they are used and whether they are still valid. That is a lifecycle and accountability issue, not only a security settings issue.
Q: How should teams reduce the blast radius of a leaked private key?
A: Keep private keys inside hardware-backed storage, minimise exportability, and ensure revocation paths are ready before a compromise happens. The goal is to prevent a leaked key from being usable as a broad trust primitive across authentication, encryption, or code-signing workflows.
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable. The turning point is not a specific count, but the moment certificates span teams, tools, and infrastructure layers that no single person can track safely.
Technical breakdown
Why public and private keys require different governance controls
Public keys are designed to be shared, verified, and embedded in certificates. Private keys are the secret half of the pair and are used to decrypt data or create signatures that prove origin. In PKI, that distinction matters because the public key can be distributed widely, while the private key must remain protected in storage, transit, and use. When organisations blur those responsibilities, trust becomes brittle: exposure of the private key turns authentication, confidentiality, and code-signing into one compromise path.
Practical implication: Treat private key custody as a distinct control domain from certificate distribution and verification.
Why certificate lifecycle automation becomes mandatory at scale
Certificates are not static assets. They are issued, renewed, revoked, and retired, and each stage needs visibility across cloud, on-premises, DevOps, and edge environments. The article’s key operational point is that millions of certificates cannot be governed reliably with spreadsheets or siloed tools. As certificate counts rise, manual tracking creates blind spots, expired certificates, and delays in renewal or revocation. That is a lifecycle problem, not just an inventory problem.
Practical implication: Build continuous discovery and automated renewal workflows before certificate volume exceeds manual governance capacity.
How private key compromise turns into impersonation and trust failure
A compromised private key is not only a stolen secret. It is a reusable trust primitive that can be used to impersonate systems, decrypt protected data, or sign malicious software. Because private keys sit behind authentication and signing workflows, compromise often produces second-order effects in service trust, software integrity, and access to cloud workloads. The article also points to revocation mechanisms such as CRLs and OCSP as the trust backstops when a key or certificate can no longer be considered valid.
Practical implication: Isolate private keys in hardware-backed storage and ensure revocation paths are operational before compromise occurs.
Threat narrative
Attacker objective: The attacker aims to use a stolen private key to impersonate trusted systems or sign malicious code while avoiding normal authentication barriers.
- Entry occurs when a private key is exposed through weak storage, accidental inclusion in logs or crash dumps, or other lifecycle failures around key handling.
- Credential access follows because the attacker now possesses a reusable trust artifact that can decrypt traffic, authenticate as a system, or sign code.
- Escalation and impact occur when that key is used to impersonate trusted services, bypass authentication, or undermine software and data integrity at scale.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- Secrets in Docker Hub images (RWTH Aachen study): A 2023 RWTH Aachen study found secrets in 8.5% of container images, and 275,269 internet hosts still using the leaked private keys.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Public and private key governance fails when organisations treat trust material as static inventory. The article shows that certificates and keys only remain trustworthy when issuance, renewal, revocation, and storage are managed as a living lifecycle. Once those controls become spreadsheet-driven, scale turns routine administration into systemic exposure. The practitioner lesson is that PKI governance is a control system, not a documentation exercise.
Private key protection is the decisive control boundary in asymmetric trust. Public keys can be shared broadly, but private keys are the assets that convert identity into usable trust. When private keys are stored in plain text files, exposed in dumps, or left outside hardware-backed protection, the organisation has already lost the distinction that PKI depends on. Teams should treat key custody as the point where authentication either holds or fails.
Certificate inventory blind spots are a governance failure, not an operational nuisance. The article’s scale argument is the important one: millions of certificates make incomplete visibility functionally equivalent to no governance. That is why automated discovery matters more than periodic clean-up. The practitioner implication is to manage certificates as continuously changing trust objects, not as static records in a register.
Crypto-agility is becoming a lifecycle requirement rather than a future-state ambition. Shorter certificate lifespans and the article’s reference to rapid change in cryptographic expectations mean renewal pace and algorithm agility now affect operational resilience. Organisations that wait for a forced migration will discover that their trust estate cannot move quickly enough. The conclusion is straightforward: the time to redesign certificate governance is before the next expiry wave arrives.
Public key vs private key management is really identity blast-radius management. The failure mode is not just leakage, but the ability of a compromised key to amplify trust far beyond its original scope. That makes inventory, revocation, and storage controls part of broader identity security rather than narrow PKI hygiene. For practitioners, the question is how far a single key can reach if it is ever exposed.
From our research library:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
What this signals
Identity trust only scales when certificate governance is treated as an automated lifecycle. Manual handling collapses once certificate counts rise, because ownership, renewal, and revocation all become moving targets. For practitioners, the signal is clear: trust material has to be managed like a living estate, not a static register.
Private key protection is the control that decides whether PKI failures stay contained. The article shows that a compromised key can turn into impersonation or malicious signing, which means storage boundary design matters as much as issuance policy. Teams should focus on where keys can be copied, exposed, or exported, then reduce those paths.
PKI programmes now need crypto-agility planning as a normal operating requirement. Shorter certificate lifespans and changing cryptographic expectations make slow renewal processes a resilience issue, not just a maintenance issue. That shifts the programme conversation from periodic cleanup to continuous readiness.
For practitioners
- Map every private key to an owner and lifecycle state Build a complete inventory that ties each private key and certificate to a system owner, issuance source, usage context, and renewal date. Include cloud, on-premises, DevOps, and IoT estates so orphaned trust material does not remain outside governance.
- Move private keys into hardware-backed protection Store private keys in HSMs or equivalent vault-backed controls, and restrict plaintext storage in files, repos, crash dumps, and build artefacts. Where possible, generate keys on device or in the protected boundary rather than exporting them.
- Automate discovery and renewal before expiry Run continuous discovery across all environments and trigger renewal workflows early enough to prevent outage windows. Treat renewal as a governed workflow, not a manual reminder task.
- Operationalise revocation for compromised trust material Verify that CRLs and OCSP are usable in practice, not just documented in policy, and rehearse the steps for invalidating a certificate or key that is suspected to be compromised.
Key takeaways
- Public key and private key management fails when organisations treat certificates as static objects instead of lifecycle-governed trust assets.
- At enterprise scale, manual oversight creates blind spots that can lead to outages, failed audits, and compromised authentication.
- The practical fix is continuous discovery, protected private key storage, and revocation and renewal processes that operate at the pace of the estate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article stresses that private keys must never be exposed in plaintext or crash dumps. |
| NHI-07 — Long-Lived Secrets | Expired or unmanaged certificates and keys create long-lived trust exposure across the estate. | |
| Recommendation — Scan for exposed private keys and eliminate plaintext storage paths across the trust estate. Automate renewal and retirement so certificates and keys do not remain trusted beyond their intended life. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article is fundamentally about lifecycle control over authenticators and trust material. |
| Recommendation — Apply authenticator lifecycle controls to issue, rotate, revoke, and retire keys and certificates. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | Stolen private keys enable credential abuse and downstream service or integrity impact. |
| Recommendation — Map key theft to credential-access and impact tactics and prioritise detection around key exposure paths. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Certificate and key governance is an identity control problem in cloud estates. |
| Recommendation — Use IAM controls to govern certificate ownership, access, and revocation across cloud environments. | ||
Key terms
- Public Key Infrastructure: Public Key Infrastructure is the trust system that issues, manages, and revokes digital certificates used to prove identity. In practice it binds keys to entities and policies, making authentication, encryption, and non-repudiation possible across users, devices, and services.
- Private Key: A private key is the secret half of an asymmetric cryptographic pair used to prove identity or sign data. In operational environments it can authenticate services, sign tokens, or decrypt traffic, which makes exposure a trust failure, not just a confidentiality issue.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org