How should organisations secure connected cars with PKI?

Why This Matters for Security Teams

Connected cars depend on software-defined trust across dozens of ECUs, telematics modules, mobile apps, roadside services, and cloud backends. PKI gives security teams a way to bind that trust to cryptographic identity instead of IP address, network segment, or device location. That shift matters because the vehicle environment is inherently distributed, long-lived, and exposed to maintenance workflows, third-party suppliers, and wireless attack paths. Current guidance suggests treating certificates as operational security controls, not paperwork.

This is also a non-human identity problem. Vehicle components authenticate as workloads, not people, and their credentials need lifecycle governance, renewal, revocation, and visibility. The Ultimate Guide to NHIs notes that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which is a useful warning for any machine-driven trust model. For connected vehicles, the same pattern appears when long-lived certs, weak issuance, or missed revocation create silent persistence.

Practitioners should map PKI to the broader control set in NIST Cybersecurity Framework 2.0, especially asset visibility, access control, and recovery. In practice, many security teams encounter certificate abuse only after a supplier key or OTA signing credential has already been misused, rather than through intentional lifecycle monitoring.

How It Works in Practice

A secure connected-car PKI usually has three trust layers: component identity, software integrity, and communications security. First, each vehicle subsystem receives a unique cryptographic identity, often backed by hardware such as a TPM or secure element. That identity lets the car prove “what it is” to back-end services, diagnostic tools, or partner ecosystems. Second, firmware, OTA packages, and calibration files should be signed so the vehicle can verify integrity before installation. Third, the car and external services should use mutual authentication for data exchange, especially for telematics, remote commands, and fleet services.

Operationally, that means certificate issuance, renewal, revocation, and inventory cannot be manual side tasks. Best practice is to define:

• unique identities per vehicle, ECU, and service, not shared certificates across fleets
• short-lived certificates where feasible, with automated renewal before expiry
• rapid revocation paths for compromised suppliers, modules, or signing authorities
• policy checks that only allow approved firmware, domains, and backend endpoints
• audit trails for issuance, rotation, and failed validation events

The Ultimate Guide to NHIs is relevant here because PKI for vehicles is really lifecycle management for machine identity. Even when a certificate is technically valid, security posture depends on whether it is still appropriate for the component, supplier, region, or software version involved. NIST guidance also reinforces that identity, authentication, and monitoring should be built into normal security operations, not added after deployment.

Where this guidance breaks down is in legacy vehicle platforms with limited secure storage, poor clock synchronisation, or supplier ECUs that cannot support unique certificates and automated renewal.

Common Variations and Edge Cases

Tighter PKI control often increases operational overhead, requiring organisations to balance stronger trust guarantees against vehicle uptime, manufacturing complexity, and field service constraints. That tradeoff is especially visible in mixed fleets, where new models support hardware-backed keys but older platforms rely on software-only trust stores.

There is no universal standard for this yet, but current guidance suggests a few pragmatic variations. Some organisations use a separate certificate chain for in-vehicle trust and another for external cloud services, which limits blast radius if one trust domain is compromised. Others issue extremely short-lived credentials for service tooling and diagnostic portals, while allowing longer-lived device certificates for constrained embedded modules. Both approaches can work if revocation is actually enforced.

Edge cases also matter. Offline vehicles may not receive revocation checks in real time, so teams need compensating controls such as grace windows, staged update policies, and risk-based quarantine. Supplier ecosystems are another weak point: if a third-party ECU or mobile maintenance app holds its own signing or access credentials, those secrets should be governed like any other NHI. The main failure mode is assuming the car is secure because the network is encrypted, when the real risk is compromised trust material inside the supply chain.

For broader identity governance patterns that apply here, the same Ultimate Guide to NHIs data shows why rotation and offboarding discipline matter. In connected-car environments, missed revocation is rarely a theoretical gap; it becomes a field incident when a lost supplier key or stale certificate still validates months later.

Related resources from NHI Mgmt Group

• How can organizations secure their MCP server credentials?
• How can organisations secure third-party privileged access in hybrid environments?
• How should organisations secure workflow platforms that handle both files and secrets?
• When should organisations modernise PKI instead of keeping legacy processes?