Topic starter
11/07/2026 1:54 pm
TL;DR: PKI remains the trust layer for TLS, device authentication, signed code, and encrypted traffic, but the article argues that most failures come from manual handling, expired certificates, fragmented tooling, and weak lifecycle ownership rather than from cryptography itself, according to GlobalSign. The governance problem is no longer whether PKI works, but whether organisations can operate it as a living identity system instead of a set-and-forget control.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “PKI ist nicht tot, sie wird nur falsch genutzt”.
Key questions
Q: What breaks when private PKI is deployed without lifecycle governance?
A: Private PKI breaks down when teams do not maintain clear ownership of issuance, trust configuration, renewal, and revocation.
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable.
Q: What are the signs that PKI governance is failing in a cloud-first organization?
A: Common warning signs include teams using spreadsheets or outdated tools to manage certificates, DevOps groups issuing identities outside security visibility, and inconsistent handling of certificates across environments.
Practitioner guidance
- Implement a single certificate inventory Create one authoritative inventory for certificates, private keys and issuing authorities so renewal, revocation and ownership are visible across teams.
- Automate renewal and revocation workflows Replace spreadsheet-based renewals with policy-driven automation that renews, replaces or revokes certificates before expiry windows create outages.
- Assign explicit certificate owners Name a business or technical owner for each certificate class, including service, device and application identities, so no certificate sits without accountability.
Bottom line: PKI problems usually come from governance failure, not from weak cryptography.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:05 pm
PKI lifecycle governance is now an identity governance problem, not a niche certificate task. Certificates increasingly anchor machine authentication, service trust and encrypted traffic, so the control model now overlaps directly with NHI governance and credential lifecycle management. A team that cannot inventory, own and revoke certificates is running a trust layer without lifecycle controls. The practitioner conclusion is that PKI belongs inside identity governance, not outside it.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: Who should own certificate risk in DevOps and workload identity programmes?
A: Ownership should sit with the team accountable for the workload and with the identity or security function responsible for policy. If no one owns issuance, renewal, and revocation, certificates become shared infrastructure debt. Clear accountability is essential because machine identities behave like access credentials, not passive configuration objects.
👉 Read our full editorial: PKI is not dead: why lifecycle governance is the real failure