Topic starter
11/07/2026 8:23 pm
TL;DR: PKI is presented as a 90-day governance and architecture programme, not a simple technology rollout, with emphasis on certificate policy, CA hierarchy, HSM-backed key storage, and lifecycle management across issuance, renewal, and revocation according to eMudhra. The real security issue is that certificate trust fails when ownership, monitoring, and offboarding are weak, making identity lifecycle discipline the deciding factor.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “90-Day PKI Deployment for Indian Enterprises”.
Key questions
Q: How should security teams automate PKI certificate management without losing control?
A: Security teams should automate routine certificate issuance, renewal, and inventory updates under explicit policy.
Q: What breaks when certificate ownership is not clearly assigned?
A: When ownership is unclear, renewal becomes inconsistent, orphaned certificates persist, and no one can prove which services still rely on outdated trust.
Q: Should organisations build PKI in-house or use a managed service?
A: That decision depends on whether the organisation can sustain the governance, key custody, monitoring, and lifecycle operations itself.
Practitioner guidance
- Define certificate ownership before rollout Assign clear owners for issuance, renewal, revocation, expiry monitoring, and exception handling across IT, security, and compliance.
- Document the PKI trust model Write the Certificate Policy and Certification Practice Statement before production issuance so approval paths and assurance levels are unambiguous.
- Use HSM-backed key custody Keep root and issuing CA keys in hardware-protected storage and restrict access to the smallest operational set possible.
Bottom line: PKI becomes a governance problem when organisations treat certificate trust as a deployment task instead of an ongoing lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:52 pm
PKI deployment is a governance programme, not a technology purchase. The article is right to put policy, roles, compliance scope, and operating model ahead of certificate issuance. PKI fails most often when organisations treat it as an engineering task and leave ownership ambiguous across IT, security, compliance, and legal. The practitioner lesson is to govern trust creation as a lifecycle, not a project milestone.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: How do I know if a PKI deployment is actually working?
A: Look for evidence that certificates are issued according to policy, keys are protected appropriately, renewals happen on time, revocations are reliable, and unauthorized requests are detected. If those signals are weak, PKI may exist technically but still fail as a trust service.
👉 Read our full editorial: PKI deployment is a certificate lifecycle governance problem