Topic starter
10/07/2026 9:17 pm
TL;DR: Digital certificate use has grown 30% since 2021, but the article says organisations still struggle with duplicate copies, insecure storage, weak auditability and lifecycle management across issuance, renewal and revocation, according to Vintegris. That turns certificate governance into an identity and compliance problem, not just a cryptography problem.
Editorial analysis by NHI Mgmt Group, based on content published by Vintegris: “Riscos ocults en lús dels Certificats Digitals”.
By the numbers:
- From 2021, the number of transactions and digital certificates managed by organisations has increased by 30%.
Key questions
Q: How should organisations govern digital certificates in shared and remote environments?
A: They should treat certificates as controlled credentials, not portable files.
Q: What breaks when digital certificates are copied across multiple devices?
A: When certificates are copied across multiple devices, the organisation loses control over which instance is authoritative.
Q: When does certificate storage become a compliance risk?
A: Certificate storage becomes a compliance risk when teams cannot prove custody, purpose and lifecycle state for each credential.
Practitioner guidance
- Establish a single certificate inventory Record every certificate, private key location and device copy in one authoritative inventory so renewal and revocation act on the full estate.
- Remove unmanaged local copies Eliminate certificate storage on shared endpoints and unmanaged devices where custody, logging and revocation are not enforceable.
- Tie certificate use to explicit authorisation Require documented purpose, owner and approved applications for each certificate so use remains traceable and reviewable.
Bottom line: Digital certificate governance fails when custody, inventory and lifecycle control do not move together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:39 pm
Certificate governance is now an identity control problem, not a crypto problem. The article's most important point is that digital certificates behave like identities with custody, scope and expiry, not like static files. Once organisations manage them across devices, users and locations, the control challenge becomes lifecycle governance and evidence. Practitioners should therefore place certificates inside the same governance model used for other high-trust credentials.
A question worth separating out:
Q: What is the difference between certificate management and certificate lifecycle management?
A: Certificate management is often treated as tracking issuance and expiry, while certificate lifecycle management includes ownership, policy, renewal, revocation, and offboarding. That broader lifecycle view is the only one that scales when certificates behave like machine identities. Practitioners should govern the full lifecycle, not just the expiry date.
👉 Read our full editorial: Digital certificate governance risks are outpacing enterprise controls