Topic starter
11/07/2026 8:23 pm
TL;DR: Certificate trust in eMudhra's view depends on governance across policy, CA hierarchy, HSM-backed key storage, and the certificate lifecycle, not on the deployment itself according to eMudhra. Certificate programs need ownership, monitoring, and revocation discipline or trust can decay after rollout.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “90-Day PKI Deployment for Indian Enterprises”.
Key questions
Q: What breaks when certificate ownership is not clearly assigned?
A: When ownership is unclear, renewal becomes inconsistent, orphaned certificates persist, and no one can prove which services still rely on outdated trust.
Q: Should organisations build PKI in-house or use a managed service?
A: That decision depends on whether the organisation can sustain the governance, key custody, monitoring, and lifecycle operations itself.
Q: How should security teams automate PKI certificate management without losing control?
A: Security teams should automate routine certificate issuance, renewal, and inventory updates under explicit policy.
Practitioner guidance
- Define certificate ownership before rollout Assign clear owners for issuance, renewal, revocation, expiry monitoring, and exception handling across IT, security, and compliance.
- Document the PKI trust model Write the Certificate Policy and Certification Practice Statement before production issuance so approval paths and assurance levels are unambiguous.
- Use HSM-backed key custody Keep root and issuing CA keys in hardware-protected storage and restrict access to the smallest operational set possible.
Bottom line: PKI becomes a governance problem when organisations treat certificate trust as a deployment task instead of an ongoing lifecycle.
Glossary terms: Certificate Policy, Certification Practice Statement, Certificate Lifecycle Management, Hardware Security Module
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 hours ago by NHI Mgmt Group
11/07/2026 8:52 pm
PKI deployment is a governance programme, not a technology purchase. The article is right to put policy, roles, compliance scope, and operating model ahead of certificate issuance. PKI fails most often when organisations treat it as an engineering task and leave ownership ambiguous across IT, security, compliance, and legal. The practitioner lesson is to govern trust creation as a lifecycle, not a project milestone.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: How do I know if a PKI deployment is actually working?
A: Look for evidence that certificates are issued according to policy, keys are protected appropriately, renewals happen on time, revocations are reliable, and unauthorized requests are detected. If those signals are weak, PKI may exist technically but still fail as a trust service.
👉 Read our full editorial: PKI deployment is a certificate lifecycle governance problem