Notifications
Clear all
Topic starter
25/06/2026 10:35 pm
TL;DR: Automated private PKI certificate issuance for DevOps and internal build environments is the focus of DigiCert’s partnership with Venafi, aiming to secure short-lived workloads without slowing delivery according to DigiCert. The underlying governance problem is that certificate handling still assumes human-paced provisioning, while DevOps now demands policy-driven, machine-speed trust.
NHIMG editorial — based on content published by DigiCert: Advancing the Goal of Automated PKI for More Secure DevOps
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
- Only 38% have automated certificate lifecycle management in place.
- 57% of organisations lack a complete inventory of their machine identities.
Questions worth separating out
Q: How should security teams automate certificate management in DevOps environments?
A: Security teams should embed certificate issuance, renewal, and revocation into orchestration and deployment workflows so certificates follow workload creation and teardown.
Q: Why do short-lived workloads create problems for certificate governance?
A: Short-lived workloads compress the time available for request, approval, installation, and rotation.
Q: What breaks when certificate lifecycle management is still manual?
A: Manual certificate lifecycle management breaks down when workloads are provisioned faster than operators can track them.
Practitioner guidance
- Map certificate issuance to workload lifecycle Tie issuance, renewal, and revocation to the creation and teardown of build and test systems so certificates do not outlive the workload they protect.
- Replace ticket-driven PKI steps with orchestration hooks Integrate certificate requests into deployment pipelines and orchestration tools so encryption is applied during provisioning, not after the environment is already live.
- Define ownership for every machine identity Assign a clear business and technical owner to each certificate-backed workload so inventory, renewal, and revocation decisions are accountable.
What's in the full article
DigiCert's full blog post covers the operational detail this post intentionally leaves for the source:
- The specific way DigiCert APIs connect certificate issuance into DevOps tooling and orchestration layers.
- The example workflow for creating a private PKI trust environment for internal build systems.
- The implementation detail behind limited-use private PKI certificates for short-lived testing environments.
- The article's own framing of how certificate policy differs between internal and public trust use cases.
👉 Read DigiCert's analysis of automated PKI for DevOps and private trust →
Automated PKI for DevOps environments: are your TLS controls keeping up?
Explore further
25/06/2026 11:10 pm
Automated PKI is a machine identity control problem, not a certificate convenience feature. The article frames certificates as a way to make DevOps faster, but the governance issue is whether non-human identities can be issued, constrained, and retired at the same pace as workloads. That makes certificate lifecycle management part of NHI governance, not just transport security. Practitioners should treat PKI automation as identity lifecycle infrastructure.
A few things that frame the scale:
- Only 38% have automated certificate lifecycle management in place, according to The Critical Gaps in Machine Identity Management report.
- 59% of companies face greater difficulties auditing machine identities, primarily due to lack of clear ownership and limited visibility.
A question worth separating out:
Q: Who should own certificate risk in DevOps and workload identity programmes?
A: Ownership should sit with the team accountable for the workload and with the identity or security function responsible for policy. If no one owns issuance, renewal, and revocation, certificates become shared infrastructure debt. Clear accountability is essential because machine identities behave like access credentials, not passive configuration objects.
👉 Read our full editorial: Automated PKI for DevOps: why certificate orchestration matters
