Notifications
Clear all
Topic starter
10/07/2026 9:26 pm
TL;DR: Certificate lifecycle management still hinges on inventory, role-based workflows, self-service recovery, autoenrollment, and monitoring across supported CAs, according to Secardeo’s whitepaper on certLife. The real issue is not certificate creation but the governance assumption that ownership, visibility, and revocation can be managed manually at enterprise scale.
NHIMG editorial — based on content published by Secardeo: Verwaltung von Zertifikaten im Lebenszyklus mit Secardeo certLife
By the numbers:
- Only 38% have automated certificate lifecycle management in place.
- 57% of organisations lack a complete inventory of their machine identities.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should security teams govern certificate lifecycles across mixed environments?
A: Security teams should govern certificate lifecycles through inventory, ownership, renewal policy, and revocation tracking, not by relying on ad hoc administration.
Q: What breaks when certificate ownership is not clearly assigned?
A: When ownership is unclear, renewal becomes reactive, revocation is delayed, and expired certificates are often discovered only after outages or access failures.
Q: When does certificate automation reduce risk rather than add it?
A: Automation reduces risk when issuance, renewal, and monitoring are tied to policy and role boundaries.
Practitioner guidance
- Build a unified certificate inventory Map every certificate and SSH key to an owner, asset, issuer, expiry date, and renewal path so gaps are visible before automation is attempted.
- Separate renewal from recovery workflows Reserve private key recovery for tightly controlled roles, and log every exception so the recovery path cannot become a standing privilege.
- Automate expiry and revocation escalation Send certificate expiry, renewal failure, and revocation events into the same operational monitoring and alerting channels used for other identity controls.
What's in the full article
Secardeo's full whitepaper covers the operational detail this post intentionally leaves for the source:
- Supported CA workflows and what that means for enterprise certificate standardisation
- How self-service, private key recovery, and central autoenrollment are structured in certLife
- How events, states, and statistics are exposed for certificate operations monitoring
- Which certificate and SSH key inventories can be centralised across servers and systems
👉 Read Secardeo's whitepaper on certificate lifecycle management with certLife →
Certificate lifecycle governance: what should IAM teams fix first?
Explore further
10/07/2026 9:47 pm
Certificate lifecycle is an identity governance problem, not a clerical one. The whitepaper’s focus on inventories, roles, self-service, and monitoring reflects a core truth: certificates are operational identities that outlive the systems and teams that created them. When governance is fragmented, expiry becomes an outage risk and revocation becomes an exception process. Practitioners should treat certificate lifecycle as a control plane for machine identity, not a back-office task.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who should control private key recovery in certificate operations?
A: Private key recovery should be limited to narrowly defined roles with strong logging and approval rules. If recovery is broad or informal, the workflow becomes a privileged access path rather than a resilience control, and that weakens the entire lifecycle model.
👉 Read our full editorial: Certificate lifecycle governance remains the hard problem in NHI
