Topic starter
10/07/2026 9:22 pm
TL;DR: As certificate lifetimes shrink from years toward 47 days, unknown and undocumented certificates become a rapid-fire availability and governance risk, especially for lean teams that cannot rely on manual tracking, according to GlobalSign. The real issue is not rotation itself but the identity ownership and lifecycle controls that determine whether certificates stay visible, attributable, and remediable.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Die gefährlichsten Zertifikate für Ihr Unternehmen sind die, von deren Existenz Sie gar nichts wissen”.
Key questions
Q: What breaks when machine certificates are not inventoried and revoked properly?
A: When machine certificates are not inventoried and revoked properly, old devices and exposed systems can keep authenticating long after they should have lost access.
Q: Why do shorter certificate lifetimes create more operational risk?
A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption.
Q: How should security teams measure whether certificate governance is actually working?
A: Use operational signals, not policy statements.
Practitioner guidance
- Implement continuous certificate discovery Scan servers, cloud workloads, endpoints, containers, and legacy platforms so every certificate can be inventoried before it expires or goes undocumented.
- Assign certificate ownership to accountable teams Map each certificate to a system owner or service owner and remove any certificate that cannot be tied to a responsible operating group.
- Automate renewal for routine certificate lifecycles Use CLM workflows to renew, replace, and retire certificates automatically wherever the environment allows, reserving manual handling for exceptions.
Bottom line: Unknown certificates become risky because they sit outside ownership, inventory, and renewal controls until expiry creates an outage.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:44 pm
Unknown certificates are a lifecycle governance problem, not a PKI housekeeping issue. The article shows that the risk emerges when certificates exist outside the inventory, ownership, and renewal model. That shifts the problem from technical hygiene to identity governance, because the organisation cannot manage what it cannot attribute. The practitioner takeaway is that certificate visibility is now part of core identity control.
A question worth separating out:
Q: Should organisations treat certificates and tokens like other non-human identities?
A: Yes. Certificates and tokens are identities with authority, reach, and lifecycle risk, even if they do not look like accounts. They should be governed with ownership, expiry, rotation, and revocation controls, because the damage usually comes from stale trust, not from the credential format itself.
👉 Read our full editorial: Unknown certificates are becoming the new PKI risk problem