Topic starter
11/07/2026 8:26 pm
TL;DR: Automation is increasingly being used by cybercriminals to improve phishing and other scams, while the same pattern is now being applied to PKI certificate management to reduce manual error, improve scalability, and support compliance, according to GlobalSign. The underlying issue is not automation itself but whether certificate and identity processes can remain visible, governed, and revocable when lifecycles move faster than spreadsheets and manual checks can track.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Los hackers utilizan la automatización; ¿por qué tú no?”.
Key questions
Q: How should organisations automate certificate renewal without losing control?
A: Automate the predictable parts of renewal, especially for low-risk certificates with repeatable trust paths, and keep human review for exceptions and high-impact systems.
Q: Why do spreadsheet-based certificate processes fail in modern PKI environments?
A: Spreadsheet-based processes fail because certificate lifecycles are too dynamic for manual tracking to stay current.
Q: What breaks when certificate ownership is not mapped to identities?
A: Ownership gaps break accountability, renewal coordination, and change planning.
Practitioner guidance
- Establish a single certificate inventory Create one authoritative record for all certificates, including owner, system, expiry date, renewal path, and revocation authority.
- Automate renewal before expiry thresholds Define lifecycle thresholds that trigger renewal workflows early enough to prevent service disruption and avoid last-minute manual exceptions.
- Link certificate revocation to identity change Ensure certificate revocation is triggered when an owner leaves, a service is decommissioned, or a trust relationship changes.
Bottom line: PKI automation reduces manual error, but it does not solve governance on its own.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:55 pm
Automation does not remove PKI governance debt, it exposes it. The article is right to separate automation from security outcomes. In PKI, automating issuance and renewal only helps if ownership, inventory, and revocation remain authoritative, otherwise the environment simply becomes faster at reproducing the same blind spots. The practitioner conclusion is that automation must be paired with a governed certificate lifecycle, not used as a substitute for one.
A question worth separating out:
Q: What is the difference between certificate automation and certificate governance?
A: Certificate automation executes issuance, renewal, and revocation workflows. Certificate governance defines who owns the certificate, which systems are allowed to use it, when it must be rotated or removed, and how exceptions are approved. Automation without governance is only faster administration, while governance gives the automation clear boundaries.
👉 Read our full editorial: Automation in PKI certificate management and identity risk