Topic starter
06/06/2026 2:15 am
TL;DR: Certificate provisioning is averaging 90 minutes per certificate, while automation can cut that to two minutes, support 16x certificate growth with the same staff, and contribute to a 356% ROI and $9.9 million NPV over three years, according to Keyfactor. The governance issue is no longer certificate handling speed alone, but whether identity programmes can scale machine trust without multiplying manual error and outage risk.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “5 Numbers from the Forrester TEI That Should Change How You Think About PKI”.
By the numbers:
- Provisioning certificates takes an average of 90 minutes per certificate.
- Automation can cut certificate provisioning from 90 minutes to two minutes.
Key questions
Q: Why does certificate provisioning become a governance bottleneck at scale?
A: Because certificate lifecycle work includes multiple handoffs, approval steps, and deployment tasks, each of which adds latency and error risk.
Q: How should organisations automate certificate renewal without losing control?
A: Automate the predictable parts of renewal, especially for low-risk certificates with repeatable trust paths, and keep human review for exceptions and high-impact systems.
Q: What breaks when certificate ownership is not clearly assigned?
A: When ownership is unclear, renewal becomes inconsistent, orphaned certificates persist, and no one can prove which services still rely on outdated trust.
Practitioner guidance
- Map certificate ownership and expiry metadata Build a complete inventory of certificates with owner, expiry date, and deployment location so renewal decisions are based on current state rather than tribal knowledge.
- Automate routine renewal workflows Use automated renewal for predictable, low-risk certificates and reserve manual approval only for certificates tied to high-impact services or unusual trust paths.
- Reduce manual installation steps Remove human installation from standard renewal paths where possible, because incorrect deployment is a major source of avoidable certificate outages.
Bottom line: Certificate automation matters because the real issue is lifecycle governance, not just faster certificate issuance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 3:48 am
Certificate governance is now an identity lifecycle problem, not a ticketing problem. Manual certificate handling breaks down because lifecycle events are recurring and time-sensitive, not exceptional. As machine identities multiply, the control question shifts from whether a certificate can be issued to whether it can be governed across its full life. Practitioner implication: treat certificate operations as a core identity programme function.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: Why do certificate lifecycle changes matter for NHI governance?
A: Certificates are non-human credentials with an operating life, so issuance alone is not enough. Governance depends on revocation, revalidation, and visibility into whether the certificate is still trusted by the issuing authority. If those checks lag, the organisation keeps stale access paths alive after the credential should have been removed.
👉 Read our full editorial: PKI automation is redefining certificate governance at enterprise scale