Notifications
Clear all
Topic starter
10/07/2026 9:09 pm
TL;DR: Manual certificate management is breaking under shorter lifecycles, higher certificate counts, and the risk of expired or misconfigured certificates causing outages and security gaps, according to GlobalSign. The governance issue is no longer efficiency alone: certificate operations now sit squarely inside identity and trust control.
NHIMG editorial — based on content published by GlobalSign: automated certificate management and why manual certificate handling no longer scales
Questions worth separating out
Q: How should security teams automate certificate management without losing control of keys?
A: Treat issuance automation and private key custody as separate decisions.
Q: Why do short certificate lifecycles increase operational risk?
A: Shorter lifecycles compress the time available to detect, approve, deploy, and verify renewals.
Q: What breaks when certificate discovery is incomplete?
A: Incomplete discovery means expired, duplicated, or orphaned certificates remain outside normal governance.
Practitioner guidance
- Build a complete certificate inventory Map every internal and external certificate, its owner, renewal date, issuance path, and dependent service so nothing sits outside governance.
- Separate issuance from key custody Define who can request, approve, issue, store, rotate, and revoke private keys before expanding automation.
- Design renewal workflows with audit evidence Require logging, exception handling, and renewal reporting inside the automated workflow so compliance data is produced as part of normal operations.
What's in the full article
GlobalSign's full article covers the operational detail this post intentionally leaves for the source:
- The 9-step automation checklist with implementation order and decision points for certificate teams.
- Specific product capability examples, including when ACME is sufficient and when a broader automation manager is needed.
- The article's detailed list of supported certificate workflows, such as issuance, renewal, revocation, and tracking.
- The cost-calculator framing that translates certificate count into automation savings.
👉 Read GlobalSign's guidance on automated certificate management →
Certificate automation for IAM teams: what changes now?
Explore further
10/07/2026 9:32 pm
Certificate automation is now an identity governance control, not an infrastructure convenience. The article frames automation as a way to reduce cost and errors, but the deeper issue is lifecycle control over trust credentials. Certificates, private keys, renewal timing, and revocation responsibility are governance objects, not just operational tasks. Organisations that keep certificate management outside identity programmes leave a trust control gap that widens as certificate lifetimes shorten and system counts rise. The practical conclusion is that certificate governance belongs in the same operating model as other non-human identities.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, showing how weak lifecycle governance usually is in non-human identity programmes.
A question worth separating out:
Q: When should organisations move from manual certificate handling to automation?
A: Move when renewal volume, certificate diversity, or audit pressure starts overwhelming consistent human handling. If the team already struggles to track expiry dates, private key handling, or installation consistency, the process is beyond sustainable manual control. At that point, automation is a governance necessity rather than a convenience.
👉 Read our full editorial: Automated certificate management is becoming a trust control
