Topic starter
12/07/2026 12:16 pm
TL;DR: Government agencies are under pressure to secure digital identities, encrypt communications, and manage certificates at scale, and managed PKI centralises issuance, renewal, revocation, and key handling to reduce operational burden, according to eMudhra. The governance issue is not convenience but control ownership, because certificate lifecycle failures still become identity and data protection failures.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “How Managed PKI Solutions Enhance Data Protection in Government Agencies”.
Key questions
Q: What goes wrong when certificate lifecycle is not operationally owned?
A: When no team owns certificate lifecycle, expiry, revocation, and replacement become ad hoc troubleshooting tasks instead of controlled processes.
Q: Why do managed PKI programmes still need strong governance?
A: Managed PKI removes some operational burden, but it does not remove accountability for trust decisions.
Q: What are the signs that certificate revocation is not working properly?
A: Common signs include certificates remaining trusted after compromise, redundant certificates staying active, delayed updates to certificate status, and inconsistent results between revocation lists and online status checks.
Practitioner guidance
- Define certificate ownership by system and service Create an inventory that maps each certificate to a named business service, technical owner, and renewal path so no certificate is orphaned.
- Separate key custody from certificate administration Document who can generate, store, recover, and retire private keys, and require evidence for each lifecycle step.
- Test revocation checking across all consuming systems Validate that CRLs and OCSP are actually enforced by applications, gateways, and legacy systems before a compromise forces the issue.
Bottom line: Managed PKI changes who runs certificate operations, but it does not change who remains accountable for trust decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:30 pm
Managed PKI is really certificate governance with a service wrapper: The operational burden moves, but the governance burden does not disappear. Government agencies still own identity proofing quality, certificate scope, revocation policy, and the trust decision that binds a certificate to a service, device, or person. The practical conclusion is that managed PKI should be assessed as a control model, not as a convenience purchase.
A few things that frame the scale:
- According to a recent Gartner report, 40% of government organizations are expected to establish dedicated trust operations functions by 2028 to combat deepfakes.
A question worth separating out:
Q: Should organisations centralise PKI governance or keep it local to teams?
A: Centralisation usually improves visibility, policy consistency and auditability, but only if local teams still retain clear responsibility for the systems that consume certificates. The best model is central policy with distributed operational ownership, so the trust fabric is governed once and implemented where the certificates actually run.
👉 Read our full editorial: Managed PKI in government: what it changes for certificate governance