Notifications
Clear all
Topic starter
12/07/2026 12:16 pm
TL;DR: NIS2 and DORA now push certificate lifecycle management from infrastructure hygiene into regulatory control, because encrypted communications, mutual authentication, audit trails, and third-party trust all depend on governed PKI according to eMudhra. The compliance gap is not the presence of certificates but the inability to inventory, renew, and retire them continuously across hybrid and vendor ecosystems.
NHIMG editorial — based on content published by eMudhra: NIS2 and DORA compliance PKI and certificate lifecycle management
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should organisations govern certificate lifecycle management for NIS2 and DORA?
A: Treat certificate lifecycle management as a governed identity process with named ownership, tracked inventory, renewal deadlines, and revocation evidence.
Q: Why do expired certificates create such a high operational risk?
A: Expired certificates can break authentication, encrypted sessions, and service-to-service trust at the same time, which makes them availability and security issues rather than simple maintenance misses.
Q: What do security teams get wrong about PKI in onboarding and registration?
A: They often focus on encryption strength and overlook governance.
Practitioner guidance
- Build a complete certificate inventory Start with servers, APIs, load balancers, IoT devices, code repositories, and vendor-managed endpoints.
- Map certificate lifecycle controls to regulated services Separate certificates that support critical infrastructure or financial services from lower-risk use cases, then apply stricter renewal, logging, and approval controls to the regulated set.
- Extend governance to third-party trust chains Require vendors and service providers to disclose certificate ownership, renewal cadence, and chain dependencies for any service that can impact your regulated operations.
What's in the full article
eMudhra's full article covers the operational detail this post intentionally leaves for the source:
- How emCA structures private CA issuance and custom certificate attributes for regulated environments
- How CertiNext automates discovery, renewal, retirement, and alerting across hybrid infrastructure
- How the article maps certificate lifecycle controls to NIS2 and DORA compliance expectations
- How the vendor positions certificate governance for third-party ICT and supply-chain monitoring
👉 Read eMudhra's analysis of NIS2 and DORA compliance PKI →
NIS2 and DORA compliance PKI: are your certificates governable?
Explore further
12/07/2026 12:30 pm
Certificate lifecycle governance is now a compliance control, not an IT housekeeping task. NIS2 and DORA both turn certificate validity, ownership, and renewal into regulated obligations because expired credentials can break encryption, authentication, and auditability at once. The issue is not that certificates are technical objects. The issue is that regulators now treat unmanaged certificate state as an operational resilience failure. Practitioners should reclassify certificate lifecycle management as a governed identity process.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which is the same visibility problem that makes certificate supply chains hard to govern.
A question worth separating out:
Q: Who is accountable when a vendor certificate outage affects regulated services?
A: The vendor may own the certificate, but the regulated organisation remains accountable for resilience, third-party oversight, and service continuity. That is why DORA-style governance has to include supplier certificate visibility, contractual renewal expectations, and evidence that dependency risk is monitored.
👉 Read our full editorial: NIS2 and DORA make certificate lifecycle governance unavoidable
