Notifications
Clear all
Topic starter
11/07/2026 1:58 pm
TL;DR: Endpoint-attached device identity certificates can support client authentication and device verification, but the operational burden shifts to issuance, installation, revocation, and lifecycle consistency across managed devices, according to Cybertrust Japan. The control question is no longer whether certificates work, but whether identity governance can keep pace with endpoint scale and offboarding discipline.
NHIMG editorial — based on content published by Cybertrust Japan: HENNGE One x device ID, a client-side certificate authentication test
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 69% of organisations now have more machine identities than human ones.
Questions worth separating out
Q: How should security teams govern device certificates on managed endpoints?
A: Security teams should treat device certificates as governed identities with owners, lifecycle states, and revocation triggers.
Q: Why do endpoint certificates create governance risk if lifecycle is weak?
A: Endpoint certificates create risk when they outlive the device state they were meant to represent.
Q: What breaks when certificate revocation is manual?
A: Manual revocation breaks at scale because the organisation cannot reliably keep pace with device turnover, reassignment, and incident response.
Practitioner guidance
- Map certificate issuance to a named device owner Require every endpoint certificate to record the user, business purpose, and managed device record before access is granted.
- Tie certificate validity to device lifecycle state Revoke or suspend certificates when the endpoint is retired, reassigned, or removed from management.
- Automate enrollment and revocation workflows Replace console-only issuance steps with policy-driven workflows that can issue, replace, and revoke certificates consistently across fleets.
What's in the full article
Cybertrust Japan's full blog post covers the implementation detail this post intentionally leaves for the source:
- The step-by-step device certificate issuance flow from the HENNGE One admin console.
- The exact endpoint registration choices used to bind the certificate to the iPhone UDID.
- The operational sequence for installing the certificate on the client device and validating access.
- The vendor's trial and deployment notes for teams evaluating certificate-based client authentication.
👉 Read Cybertrust Japan's walkthrough of client authentication with device identity certificates →
Device identity certificates on endpoints: are controls keeping up?
Explore further
11/07/2026 2:09 pm
Device certificate governance is endpoint identity governance, not a niche authentication add-on. When an organisation issues a certificate to a phone or laptop, it is creating a governed identity with a lifecycle, an owner, and an offboarding requirement. The article shows that access control becomes inseparable from device registration and certificate handling. Practitioners should treat endpoint certificates as a formal identity class, not as a convenience feature.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how quickly identity inventories degrade when ownership is unclear.
A question worth separating out:
Q: How do teams decide whether to use certificates or passwords for endpoint access?
A: Certificates are better when the goal is to bind access to a specific managed endpoint and reduce shared or reusable secrets. Passwords are weaker for device-level trust because they do not prove device possession. Teams should choose certificates when they can support enrollment, revocation, and asset reconciliation as part of normal operations.
👉 Read our full editorial: Device identity certificates at the endpoint: client auth tested
