Topic starter
24/10/2026 8:54 pm
TL;DR: Certificate security fails most often at renewal, revocation, and trust-store scope, Smallstep reports, not at the cryptography itself. Certificate governance has to cover ownership, automation, and constrained trust before expiry turns into outages.
Editorial analysis by NHI Mgmt Group, based on content published by Smallstep: “Everything you should know about certificates and PKI but are too afraid to ask”.
Key questions
Q: Why do trust stores create identity risk in PKI?
A: Trust stores define which certificate authorities can speak for your systems, so every extra root expands the set of parties that can issue accepted identity claims.
Q: How should security teams govern certificate trust for high-traffic services?
A: They should treat certificates as workload identities and govern them through a lifecycle model that covers issuance, validation, revocation, and retirement.
Q: What breaks when certificate lifecycle management is still manual?
A: Manual certificate management breaks at the point where expiry, ownership, and renewal do not line up.
Practitioner guidance
- Define certificate ownership and lifecycle boundaries Assign clear ownership for issuance, renewal, revocation, and trust store maintenance so certificate operations do not drift across platform teams, security teams, and application owners.
- Minimise trust store scope Limit each environment to the smallest feasible set of root certificates and separate internal trust from public Web PKI where the use case allows it.
- Automate renewal and rotation Use automation for certificate renewal, replacement, and retirement so expiry does not depend on manual intervention or brittle runbooks.
Bottom line: Certificates and PKI solve an identity problem by binding names to public keys, but the operational risk sits in trust distribution and lifecycle governance.
Glossary terms: Certificate Authority, Certificate Lifecycle Management, Trust Store, Public Key Infrastructure
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Certificate lifecycle, not certificate math, is the real governance problem. The article shows that binding names to keys is conceptually simple, while renewal, revocation, trust distribution, and root management are where programmes fail in practice. That is why certificate programmes belong inside identity governance rather than being left to ad hoc platform ownership. Practitioners should think in terms of lifecycle control first.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: What is the difference between public Web PKI and internal PKI?
A: Public Web PKI is designed for broad internet trust and depends on many external certificate authorities, while internal PKI is scoped to your own environment and can be tailored to your naming, lifetime, and trust requirements. Internal PKI is usually easier to automate and govern, because you control the policy boundary.
👉 Read our full editorial: Certificates and PKI are the control plane for machine identity
This post was modified 6 days ago by NHI Mgmt Group