Topic starter
23/06/2026 7:09 pm
TL;DR: SSL/TLS certificates authenticate public keys, encrypt client-server traffic, and underpin HTTPS trust signals such as browser padlocks and certificate validation, according to DigiCert. The practical issue is not whether the protocol exists, but whether teams can maintain certificate lifecycle discipline before expiry, misissuance, or trust failures erode access and confidence.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “SSL/TLS Certificate: What is it and Why You Need One”.
Key questions
A: Teams should reduce certificate sprawl by using SAN certificates where multiple domains or subdomains can be covered under one certificate.
Q: Why do expired or untrusted certificates block users even when the site still works?
A: Browsers trust the certificate path, not just the server’s willingness to answer requests.
Q: What are the signs that certificate governance is failing in critical infrastructure?
A: Common warning signs include unclear ownership, expired certificates, mixed use of approved and unapproved issuers, and last-minute manual renewals.
Practitioner guidance
- Inventory every certificate and owner Build a complete register of domains, subdomains, issuance dates, expiry dates, and accountable owners so no certificate is unmanaged.
- Monitor expiry and renewal windows Set alerts well before expiry and require a named operational owner for each renewal path, including wildcard and multi-domain certificates.
- Validate trust chains and CA dependencies Check that each certificate chains to a trusted authority in the environments where it is consumed, including browsers and intermediary services.
Bottom line: SSL/TLS certificates still matter because they bind domain identity to encryption and browser trust at the point where users decide whether to proceed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:01 am
Certificate trust is a governance problem, not a protocol problem. SSL/TLS already provides the mechanics for identity binding and encrypted transport. The failure mode appears when organisations assume the protocol alone guarantees trust, even though expiry, issuer trust, and certificate ownership still require active management. The practitioner conclusion is that trust must be governed throughout the certificate lifecycle, not assumed at deployment.
A question worth separating out:
Q: Should organisations centralise certificate lifecycle management or leave it with application teams?
A: Centralise the control plane, even if application teams still provide local context. Certificate issuance, renewal, revocation, and trust validation all benefit from consistent ownership and monitoring. Decentralised handling tends to create blind spots, duplicate effort, and missed expiry events across the estate.
👉 Read our full editorial: SSL/TLS certificates still anchor web trust and domain identity