Notifications
Clear all
Topic starter
24/06/2026 9:06 pm
TL;DR: Digital certificates bind identities to public keys, but their security depends on lifecycle discipline, private key protection, and revocation that many programmes still struggle to enforce, according to 1Kosmos. The real risk is not the certificate itself, but the governance gap between issuance, trust, and removal.
NHIMG editorial — based on content published by 1Kosmos: What are Digital Certificates?
Questions worth separating out
Q: How should security teams govern digital certificates in machine environments?
A: Security teams should govern certificates as part of machine identity, not as isolated crypto artefacts.
Q: Why do digital certificates fail when private keys are mishandled?
A: Certificates fail because the certificate is only proof of trust, while the private key proves control.
Q: When should organisations revoke a digital certificate instead of renewing it?
A: Organisations should revoke a certificate when the private key is compromised, the subject has changed, the service has been decommissioned, or the certificate was issued in error.
Practitioner guidance
- Map certificate ownership to identity records Attach every certificate to a named system owner, workload owner, or service account so renewal and revocation decisions have an accountable operator.
- Protect private keys as high-value secrets Store keys in controlled secret or hardware-backed storage, restrict export, and remove shared access paths that allow silent copying.
- Track issuance, renewal, and revocation as one lifecycle Build a single inventory that shows certificate expiry, renewal status, and revocation state so stale trust is visible before it becomes an incident.
What's in the full article
1Kosmos's full article covers the operational detail this post intentionally leaves for the source:
- A plain-English walkthrough of certificate creation, renewal, and revocation for readers who need a refresher on PKI mechanics.
- A breakdown of SSL/TLS, code signing, and email certificate use cases that helps teams map certificate type to control requirement.
- A practical explanation of where private key handling and trust validation fail in real deployments.
- A source-level overview of the certificate lifecycle language used in the article, useful for implementation teams.
👉 Read 1Kosmos's explanation of digital certificates and PKI →
Digital certificates and PKI: are your trust controls keeping up?
Explore further
25/06/2026 6:06 am
Digital certificates are a machine identity control, not a standalone security feature. The article correctly frames certificates as trust credentials that bind an identity to a public key, which places them inside the broader NHI governance model. That matters because the security value comes from identity proofing, ownership, and lifecycle control, not from the certificate object alone. Practitioners should manage certificates as part of machine identity policy, not as isolated crypto assets.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Another 59.8% of organisations see value in a solution that simplifies non-human access management and introduces dynamic ephemeral credentials, according to The 2024 Non-Human Identity Security Report.
A question worth separating out:
Q: What is the difference between certificate expiry and revocation?
A: Expiry ends trust automatically at a scheduled date, while revocation removes trust early because the certificate is no longer safe or appropriate to use. Expiry is time-based, but revocation is event-based and should happen when compromise, reassignment, or policy violation occurs. Both matter because a certificate can be current and still be wrong.
👉 Read our full editorial: Digital certificates and PKI are still identity trust controls
