Notifications
Clear all
Topic starter
10/07/2026 9:09 pm
TL;DR: Manual certificate management is becoming unsustainable as certificate volumes grow, renewal cycles shorten, and errors around renewal, installation, and private key handling create outage and security risk, according to GlobalSign. The governance problem is less about convenience than trust, because certificate lifecycle failures now intersect directly with access control, compliance, and operational resilience.
NHIMG editorial — based on content published by GlobalSign: why certificate management automation matters and how to approach it
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams automate certificate management without creating new trust gaps?
A: Start with inventory, ownership, and policy.
Q: Why do expired or mismanaged certificates matter to IAM and NHI programmes?
A: Certificates are machine credentials, so failure to manage them affects access trust in the same way that poor service account governance does.
Q: What do teams get wrong about certificate automation?
A: Many teams think automation is only about reducing manual work.
Practitioner guidance
- Centralise certificate inventory and ownership Build a single inventory for internal and public certificates, including expiry dates, issuing authority, application owner, and renewal path.
- Treat private keys as controlled credentials Define storage, access, and rotation requirements for private keys with the same discipline used for other non-human credentials.
- Automate renewal and revocation workflows Use policy-based workflows to issue, renew, and revoke certificates consistently across environments.
What's in the full article
GlobalSign's full article covers the operational detail this post intentionally leaves for the source:
- The 9-step checklist for moving from manual certificate handling to automation across issuance, renewal, revocation, and reporting.
- The specific feature set described for ACME and Certificate Automation Manager, including monitoring, permissions, and expiry tracking.
- The cost and benefits calculator used to estimate savings from automating certificate operations.
- The article's guidance on selecting a provider based on flexibility, trust chain, and support.
👉 Read GlobalSign's guide to automating certificate management →
Certificate automation: is your identity governance keeping pace?
Explore further
10/07/2026 9:32 pm
Certificate lifecycle debt is now an identity problem, not just a PKI problem: once certificates are treated as credentials, renewal, revocation, and key handling belong in the same governance conversation as service accounts and API keys. Manual processes create hidden persistence windows that auditors rarely see until something fails. Organisations that still separate PKI from identity governance are underestimating their real attack surface.
A question worth separating out:
Q: Who should be accountable for certificate lifecycle failures?
A: Accountability should sit with the teams that own the service using the certificate, supported by security and platform teams that enforce policy and visibility. If certificates are treated as operational assets with identity impact, then renewal, revocation, and key handling cannot be left to ad hoc administration or ticket queues.
👉 Read our full editorial: Certificate automation and the identity governance gap it closes
