Topic starter
11/07/2026 1:55 pm
TL;DR: PKI underpins digital certificates, trust chains, encryption, revocation, and authentication across organisations, devices, and services, but implementation still breaks down when key management, certificate lifecycle control, and audit discipline are weak, according to GlobalSign. The core issue is not PKI theory; it is whether identity teams can govern certificate trust at scale without creating hidden operational risk.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Public Key Infrastructure verstehen: Überblick und Schlüsselkonzepte”.
Key questions
Q: How should teams govern certificate lifecycles in a PKI programme?
A: Treat certificates as governed identity assets with named ownership, expiry tracking, and explicit revocation authority.
Q: Why do PKI environments become risky when revocation is weak?
A: Weak revocation lets a compromised certificate continue to represent trust after the underlying key or identity should have been withdrawn.
Q: What breaks when certificate inventory is incomplete?
A: Incomplete inventory breaks ownership, renewal planning, and revocation response.
Practitioner guidance
- Define certificate ownership by service and system Assign each certificate to a named business or technical owner, with explicit accountability for issuance, renewal, revocation and retirement.
- Inventory every certificate and private key path Maintain a live inventory that covers servers, websites, devices, pipelines and internal services, including issuer, expiry, renewal method and revocation status.
- Automate renewal with policy guardrails Use automation to reduce manual renewal failures, but require policy approval for high-risk certificates, short lifetimes and production trust anchors.
Bottom line: PKI remains central to digital identity trust, but the real control gap is governance over certificate lifecycle and key ownership.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:06 pm
PKI governance is an identity lifecycle problem, not a cryptography problem. The article correctly places trust at the centre of digital identity, but the operational failure mode is not weak math. It is weak ownership of issuance, renewal, revocation and expiry across a growing certificate estate. Practitioners should read PKI as a governed identity subsystem, not a standalone security utility.
A question worth separating out:
Q: Should organisations centralise PKI governance or keep it local to teams?
A: Centralisation usually improves visibility, policy consistency and auditability, but only if local teams still retain clear responsibility for the systems that consume certificates. The best model is central policy with distributed operational ownership, so the trust fabric is governed once and implemented where the certificates actually run.
👉 Read our full editorial: PKI governance is still the backbone of digital identity trust