Topic starter
11/07/2026 1:57 pm
TL;DR: Fragmented certificate ownership, inconsistent revocation tracking, and certificate sprawl create governance blind spots across hybrid and multi-cloud environments, according to eMudhra. Centralized PKI management is now an identity control problem, because certificate lifecycle, ownership, and policy enforcement determine whether machine trust is visible or merely assumed.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “From Discovery to Revocation: Building a Centralized PKI and Certificate Management Strategy”.
Key questions
Q: What breaks when certificate administration is fragmented across too many tools and teams?
A: Fragmentation makes it harder to see where certificates live, who controls them, and whether policy is being enforced consistently.
Q: Why does weak certificate validation create revocation risk for publicly trusted certificates?
A: Weak validation creates revocation risk because the trust decision was made on insufficient proof of control.
Q: How should critical infrastructure teams measure whether PKI governance is working?
A: Measure whether the organisation can renew, replace, revoke, and recover trust material across the full device estate without service disruption or ownership confusion.
Practitioner guidance
- Implement enterprise-wide certificate discovery Identify public, internal, API, microservice, mTLS, IoT, and code-signing certificates across on-prem, cloud, containers, DevOps, and edge environments.
- Assign ownership and policy to every certificate class Map each discovered certificate to a business owner, environment, risk tier, validity policy, and approved CA so lifecycle decisions are not orphaned.
- Automate issuance with role-based controls Use API-driven requests, approval workflows, and integration with internal and public CAs to remove ad hoc certificate creation from teams and pipelines.
Bottom line: Fragmented PKI creates a governance blind spot because certificates can remain active without clear ownership, policy, or revocation oversight.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:07 pm
Centralised PKI is now an identity governance control, not a back-end utility. The article correctly frames certificates as the trust basis for machine authentication across hybrid environments. That makes ownership, issuance policy, and revocation traceability identity controls in practice, because they determine who or what can still be trusted.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to the State of Secrets Sprawl 2026.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations centralise PKI before or after moving to Zero Trust?
A: Centralise PKI first or in parallel, because Zero Trust depends on accurate, current trust decisions. If certificate state is fragmented, service identity and mutual TLS controls will rest on stale assumptions. Central governance makes the trust backbone visible enough for Zero Trust to work as designed.
👉 Read our full editorial: Centralized PKI governance is now an identity security requirement