Topic starter
24/06/2026 9:06 pm
TL;DR: Digital certificates bind identities to public keys, but their security depends on lifecycle discipline, private key protection, and revocation that many programmes still struggle to enforce, according to 1Kosmos. The real risk is not the certificate itself, but the governance gap between issuance, trust, and removal.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What are Digital Certificates?”.
Key questions
Q: What breaks when certificate revocation is slow or incomplete?
A: When revocation is slow or incomplete, identities continue to authenticate after they should have been removed from trust.
Q: Why do AI agents complicate zero trust in identity and access management?
A: Zero trust assumes continuous verification of who or what is requesting access, but AI agents can chain actions, infer context, and reuse privileges in ways traditional sessions do not.
Q: How should security teams measure whether certificate governance is actually working?
A: Use operational signals, not policy statements.
Practitioner guidance
- Map certificate ownership across all environments Assign a named owner for every certificate class, including TLS, code signing, and internal service certificates, so renewal and revocation do not depend on tribal knowledge.
- Shorten the revocation path Test how long it takes from compromise detection to revocation enforcement across browsers, services, and internal applications, then close the slowest enforcement gap.
- Protect private keys as high-value secrets Store keys in controlled systems, limit export capability, and review which administrators or automation jobs can access signing material.
Bottom line: Digital certificates are still a core identity trust mechanism, but their value depends on lifecycle governance and private key protection.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:06 am
Certificate trust is a lifecycle problem, not a format problem: The certificate itself is only the proof object. The real security boundary is whether issuance, storage, renewal, and revocation keep pace with identity change. Once organisations treat PKI as a one-time setup, they create trust drift that survives long after the original identity state has changed. The practitioner takeaway is to govern certificates as living credentials.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: What is the difference between certificate issuance and certificate trust?
A: Issuance is the act of creating and signing a certificate, while trust is the ongoing decision by systems to accept that certificate as valid. A certificate can be issued correctly and still become unsafe later if the private key leaks, the identity changes, or revocation does not propagate.
👉 Read our full editorial: Digital certificates and PKI are still identity trust controls