Topic starter
25/06/2026 5:27 pm
TL;DR: Certificate validity, private key protection, and revocation are presented by DigiCert as three linked decisions that determine whether PKI reduces risk or extends it, especially as long-lived certificates, key compromise, and deprecation events like SHA-1 age into operational exposure. The governing assumption is simple: if certificates and keys can persist too long without fast replacement, revocation, and storage controls, security debt accumulates.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Mitigating Risk: The Importance of Considering Your Certificate Practices”.
Key questions
Q: How should teams choose certificate validity periods for device identities?
A: Choose validity periods based on how quickly you can reissue, replace and distribute new credentials when cryptographic assumptions change.
Q: Why do private key storage controls matter as much as certificate issuance?
A: Because a certificate only authenticates the holder if the private key stays protected.
Q: What breaks when certificate revocation is difficult to reach operationally?
A: Revocation becomes ineffective if devices cannot reliably check status through CRL or OCSP paths.
Practitioner guidance
- Define certificate validity around replacement capability Set validity periods only after confirming that reissuance, renewal and device update mechanisms can complete before trust assumptions age out.
- Move private keys into protected storage Use encrypted key stores or hardware-backed protection so certificates cannot be trivially impersonated if a device is inspected or compromised.
- Test revocation in constrained environments Validate CRL caching, OCSP reachability and stapling for devices that may not have reliable internet access, then confirm revocation can actually be enforced.
Bottom line: Certificate validity, key storage and revocation are one lifecycle problem, not three independent settings.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:07 pm
Certificate lifecycle is the control, not an administrative afterthought: This article shows that validity, replacement and revocation are inseparable governance decisions. A certificate that outlives its trust assumptions becomes a liability, even if it was issued correctly. For identity programmes, the lesson is that cryptographic trust must be managed as a lifecycle with expiry, replacement and withdrawal already engineered into it.
A question worth separating out:
Q: How do identity teams reduce risk from long-lived certificates and outdated algorithms?
A: They maintain an inventory of deployed certificates, know which ones depend on aging cryptography, and test their ability to reissue at scale when trust assumptions change. The key question is not whether the algorithm is currently acceptable, but whether the estate can be replaced before the next deprecation event forces action.
👉 Read our full editorial: Certificate practices and PKI design are a security control, not a detail