Topic starter
11/07/2026 1:55 pm
TL;DR: Certificate lifecycle and key ownership are the control gaps GlobalSign describes in PKI, where trust weakens if governance does not keep pace. Certificate inventory, renewal and revocation have to stay current or relying systems can continue to trust expired or withdrawn identities.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Public Key Infrastructure verstehen: Überblick und Schlüsselkonzepte”.
Key questions
Q: Why do PKI environments become risky when revocation is weak?
A: Weak revocation lets a compromised certificate continue to represent trust after the underlying key or identity should have been withdrawn.
Q: What breaks when certificate inventory is incomplete?
A: Incomplete inventory breaks ownership, renewal planning, and revocation response.
Q: How should teams govern certificate lifecycles in a PKI programme?
A: Treat certificates as governed identity assets with named ownership, expiry tracking, and explicit revocation authority.
Practitioner guidance
- Define certificate ownership by service and system Assign each certificate to a named business or technical owner, with explicit accountability for issuance, renewal, revocation and retirement.
- Inventory every certificate and private key path Maintain a live inventory that covers servers, websites, devices, pipelines and internal services, including issuer, expiry, renewal method and revocation status.
- Automate renewal with policy guardrails Use automation to reduce manual renewal failures, but require policy approval for high-risk certificates, short lifetimes and production trust anchors.
Bottom line: PKI remains central to digital identity trust, but the real control gap is governance over certificate lifecycle and key ownership.
Glossary terms: Public Key Infrastructure, Certificate Authority Services, Certificate Revocation List, Online Certificate Status Protocol
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
11/07/2026 2:06 pm
PKI governance is an identity lifecycle problem, not a cryptography problem. The article correctly places trust at the centre of digital identity, but the operational failure mode is not weak math. It is weak ownership of issuance, renewal, revocation and expiry across a growing certificate estate. Practitioners should read PKI as a governed identity subsystem, not a standalone security utility.
A question worth separating out:
Q: Should organisations centralise PKI governance or keep it local to teams?
A: Centralisation usually improves visibility, policy consistency and auditability, but only if local teams still retain clear responsibility for the systems that consume certificates. The best model is central policy with distributed operational ownership, so the trust fabric is governed once and implemented where the certificates actually run.
👉 Read our full editorial: PKI governance is still the backbone of digital identity trust