Unifying PKI, FIDO2, and physical access credentials

At a glance

What this is: Versasec describes how one credential management platform spans PKI, FIDO2 and physical access credentials, with a focus on lifecycle control across certificates, smart cards, PIN unblock and enterprise access methods.

Why it matters: IAM teams need a governance model that treats certificates, phishing-resistant credentials and physical access badges as related lifecycle objects, not isolated admin tasks.

Context

PKI, FIDO2 and physical access badges solve different authentication and access problems, but they often end up managed through separate operational processes. That creates lifecycle gaps when organisations issue, unblock, renew or retire credentials across multiple trust domains.

The governance challenge is not whether the credential types are useful. It is whether identity teams can maintain coherent issuance, administration and offboarding across certificates, smart cards, FIDO2 credentials and building access methods without losing auditability or creating separate exception paths.

Key questions

Q: How should teams govern PKI, FIDO2 and physical access credentials together?

A: Treat them as one credential estate with different control requirements, not as separate administration problems. Define ownership, issuance, recovery, revocation and audit responsibility for each credential type, then make sure offboarding and exception handling work across all three. If the lifecycle is split, identity assurance becomes inconsistent even when each individual tool is configured correctly.

Q: Why do separate badge, certificate and authenticator workflows create governance risk?

A: Because each workflow can preserve access independently after the identity has changed. A user may lose one credential path while another remains active, which breaks entitlement consistency and complicates evidence gathering. The risk is not only abuse. It is also the inability to prove that access state matches current employment or role state.

Q: What are the signs that credential lifecycle governance is fragmented?

A: Common signs include duplicate offboarding steps, manual recovery requests, different renewal cadences and unclear ownership between IAM, PKI and facilities teams. If auditors must ask three teams to explain the same person’s access, the lifecycle model is already fragmented. The practical test is whether one identity record can explain all active credentials without exceptions.

Q: What should organisations do if physical access badges are outside IAM control?

A: Bring physical access into the same governance model even if the operational system stays separate. At minimum, align badge issuance, deactivation, exception approval and review evidence with identity records so badge access does not outlive digital access state. That keeps the identity lifecycle coherent across buildings and systems.

Technical breakdown

How unified credential administration works across PKI, FIDO2 and badges

A unified credential platform typically centralises issuance, update, revocation and administrative workflows for multiple credential types while leaving the underlying trust mechanisms intact. PKI relies on certificates and cryptographic operations, FIDO2 uses phishing-resistant authentication hardware and protocols such as CTAP 2.1, and physical access credentials such as RFID or smart cards control entry to facilities. The architectural question is not whether these mechanisms are identical, but whether one governance plane can enforce consistent lifecycle controls across them without duplicating policy in separate systems.

Practical implication: Treat the unification layer as a governance control plane and verify that each credential class still follows its own issuance and revocation rules.

Why certificate lifecycle and physical access lifecycle are often governed separately

Certificate management is a classic machine and user credential problem, while physical access badges are often treated as facilities operations. That split creates blind spots because identity assurance, access scope and offboarding can diverge across systems. If a user leaves or changes role, a certificate may be revoked quickly while a badge remains active, or vice versa. The technical risk is inconsistent state across authoritative sources, where one credential path reflects current entitlement and another still exposes residual access.

Practical implication: Map each credential type to its authoritative owner and remove any lifecycle path that can outlive the identity record.

What enterprise FIDO2 control adds beyond consumer-style authentication

Enterprise FIDO2 management is not just about using a passkey or hardware authenticator. In an enterprise setting, administrators need control over enrolment, device binding, recovery, policy enforcement and batch issuance at scale. Versasec’s framing points to a broader operational reality: strong authentication only becomes governable when the enterprise can manage the credential lifecycle, not merely the login event. That matters when FIDO2 sits alongside PKI and physical access methods in the same organisation.

Practical implication: Make sure your FIDO2 programme includes administrative lifecycle controls, not only authentication policy.

NHI Mgmt Group analysis

Unified credential governance is becoming a lifecycle problem, not a technology problem. Once certificates, FIDO2 authenticators and physical access badges are managed in separate tools, organisations inherit different offboarding rules, different recovery paths and different audit states. That fragmentation is the real control gap, because entitlement consistency is what determines whether access is actually current. Practitioners should evaluate the lifecycle boundary, not just the authentication method.

Certificate governance and badge governance fail for the same reason when ownership is split. A certificate can be technically revoked while a building badge remains active, and the reverse is also true. That mismatch creates an identity record that says one thing and an operational access path that says another. The practitioner conclusion is straightforward: if multiple credential types feed one identity, their lifecycle states must be reconciled through a single governance model.

Enterprise FIDO2 only reduces risk when it is managed as part of the broader credential estate. FIDO2 is often discussed as a phishing-resistant authentication upgrade, but the operational value depends on who can issue, recover, rebind and retire the credential. Without that governance, strong authentication can still accumulate exceptions and manual workarounds. Teams should measure FIDO2 by lifecycle control, not by login strength alone.

Physical access credentials belong in identity governance conversations, not only facilities conversations. RFID badges, NFC credentials and smart cards are access credentials with lifecycle consequences, even if they are issued through non-IAM processes. When those credentials are excluded from identity governance, organisations leave a material gap between people, places and privileges. The practical takeaway is that physical access must be brought into the same entitlement logic as digital access.

Credential convergence is now a programme design question for IAM and security architecture teams. The more credential types that sit under one identity, the more important it becomes to define ownership, delegation and revocation rules once and apply them consistently. That does not mean forcing every credential into one product path. It means aligning the control model so the organisation can explain who owns each credential type, when it is valid and how it is retired.

From our research library:

• According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.

What this signals

Credential convergence now exposes a control boundary problem: when PKI, FIDO2 and physical badges are handled in separate operational silos, the organisation can no longer rely on one lifecycle state to explain access everywhere. The governance issue is not the number of tools, but the number of uncoordinated revocation and recovery paths.

Teams should expect more pressure to prove that certificate management, badge control and authenticators are aligned to the same joiner, mover and leaver logic. If they are not, the organisation will keep compensating with manual exceptions, which weakens both auditability and operational resilience.

For practitioners

• Define a single credential ownership model Map PKI, FIDO2 and physical access credentials to named owners, authoritative sources and revocation paths so every credential type has clear lifecycle accountability.
• Reconcile offboarding across credential types Test whether certificate revocation, badge deactivation and authenticator recovery are triggered together when a user changes role or leaves.
• Separate authentication strength from lifecycle control Assess FIDO2 and PKI programmes on issuance, recovery, rebind and retirement controls, not only on phishing resistance or cryptographic strength.
• Bring facilities credentials into identity governance Include smart cards, RFID and NFC credentials in access reviews, exception handling and audit evidence so physical access is governed alongside digital access.
• Validate administrative recovery paths Check that PIN unblock, offline recovery and emergency access flows are documented, authorised and reviewable for highly secure environments.

Key takeaways

• Unified credential management matters because lifecycle fragmentation creates inconsistent access states across certificates, authenticators and badges.
• The key operational risk is not authentication weakness alone, but misaligned ownership and offboarding across separate access channels.
• IAM teams should govern PKI, FIDO2 and physical access credentials as one estate with distinct rules, not as disconnected admin tasks.

Key terms

• Credential Lifecycle Governance: Credential lifecycle governance is the set of controls that manage creation, assignment, monitoring, rotation, and retirement of credentials. For machine identities, it prevents secrets from becoming permanent access artifacts and ensures every identity has a defined owner, purpose, and end state.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Physical access credential: A credential used to control entry to buildings, rooms or secured areas, such as an RFID badge, NFC token or smart card. These credentials are part of the broader identity estate and should be governed with the same lifecycle discipline as digital access.
• Enterprise FIDO2 Management: Enterprise FIDO2 management is the central administration of phishing-resistant credentials, including issuance, enrollment, policy enforcement, and recovery. It replaces fragmented self-service setup with controlled workflows, allowing IT to apply consistent security settings, reduce support burden, and preserve auditability across users, devices, and identity providers.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.