Notifications
Clear all
Topic starter
10/07/2026 9:14 pm
TL;DR: PKI underpins certificate trust, encryption, and identity validation across web, email, IoT, and DevOps workflows, while lifecycle controls such as renewal, revocation, and inventory management determine whether that trust remains reliable, according to GlobalSign. The governance challenge is no longer understanding PKI in theory, but keeping certificate identity visible, validated, and revocable at enterprise scale.
NHIMG editorial — based on content published by GlobalSign: PKI concepts, components, benefits, and implementation best practices
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should teams govern certificate lifecycles in a PKI programme?
A: Treat certificates as governed identity assets with named ownership, expiry tracking, and explicit revocation authority.
Q: Why does PKI matter for NHI and machine identity governance?
A: PKI gives machines, workloads, and devices a trusted way to prove identity, but that trust only holds if issuance and revocation are controlled.
Q: What breaks when certificate revocation is not enforced?
A: A certificate can remain trusted after the underlying key is compromised, the workload changes ownership, or the service should no longer be allowed to communicate.
Practitioner guidance
- Build a complete certificate inventory Map every public and private certificate across web, email, IoT, CI/CD, and internal services, then assign an owner, expiration date, and business system to each record.
- Enforce revocation checking everywhere Confirm that browsers, services, and internal applications actually consult CRLs or OCSP, and flag any workload that can continue operating with stale or revoked certificates.
- Automate renewal and renewal alerting Use policy-based workflows so certificates are renewed before expiry, with alerts tied to service owners rather than a central queue that can be ignored.
What's in the full article
GlobalSign's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanations of CA hierarchy, CSR submission, and validation flow for issued certificates
- Practical examples of where SSL/TLS, S/MIME, digital signatures, IoT identity, and DevOps use PKI in production
- A closer look at PKI management practices for key handling, renewal planning, and revocation oversight
- The article's own implementation guidance for organisations choosing a PKI operating model
👉 Read GlobalSign's guide to PKI concepts, benefits, and best practices →
PKI certificate governance: is your identity stack keeping up?
Explore further
10/07/2026 9:36 pm
PKI is identity governance for machine trust, not just cryptography. Certificates are identity assertions that bind a key to an entity, and the trust chain decides whether systems accept that assertion. That makes PKI foundational for NHI governance across servers, devices, APIs, and application workloads. Practitioners should stop treating certificate management as a narrow security utility and manage it as part of the identity control plane.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: Should organisations automate PKI before or after they centralise inventory?
A: Centralise inventory first, then automate the most repetitive lifecycle steps. Automation without inventory just accelerates bad data, while inventory without automation leaves renewal and revocation vulnerable to human delay. The right order is visibility, ownership, then controlled automation.
👉 Read our full editorial: PKI certificate governance is becoming identity infrastructure
