Common warning signs include weak device access controls, exposed data between systems, inconsistent certificate handling, and slow recovery after security incidents. If teams rely on ad hoc authentication or skip regular updates and security assessments, the trust model starts to erode. That usually shows up as unreliable services, harder incident response, and greater exposure to unauthorized access.
What PKI should look like when it is working in a smart city programme
Effective PKI should give every connected service a verifiable identity, support consistent certificate issuance and renewal, and keep trust decisions predictable across devices, gateways, APIs, and back-end systems. In a smart city programme, that means certificates are managed as part of an operating model, not as one-off setup work, so authentication remains stable as systems scale and change.
Where PKI is applied well, services can trust each other without ad hoc exceptions, certificate changes do not disrupt operations, and administrators can prove which identities are authorised to connect. The practical test is whether trust is automated, repeatable, and observable across the whole environment.
How weak PKI shows up in day-to-day operations
The first signs are usually operational, not theoretical. Devices may fall back to weaker access patterns, teams may bypass certificate checks to “keep things running,” and different systems may treat the same certificate or trust store differently. That creates inconsistent enforcement, which is often the earliest visible sign that the PKI model is not being followed end to end.
Another warning sign is certificate handling that depends on manual intervention. If renewal dates are missed, certificate chains are repaired ad hoc, or expired certificates cause service outages, the programme is not treating certificate lifecycle as a controlled security process. At that point, reliability and security problems start to reinforce each other.
A useful way to think about this is through the certificate lifecycle itself. PKI works only when issuance, rotation, revocation, expiration, and recovery are handled as normal operations. NHIMG’s Machine Identity, PKI and Certificate Lifecycle Guide is useful here because it frames certificates as managed machine identity rather than static configuration.
What poor PKI tells you about trust, resilience, and exposure
When PKI is ineffective, the problem is usually bigger than certificates alone. It often indicates weak trust boundaries between systems, poor visibility into which services are authenticating, and a lack of reliable revocation or renewal processes. In a smart city, that can affect traffic systems, sensor networks, public services, and operational dashboards at the same time.
Poor PKI also increases exposure between components that should be isolated. If certificates are misissued, reused, or left unmanaged, an attacker or an unauthorised system can exploit trust that was meant to be narrow and conditional. That is why exposed data between systems is a strong signal: the trust fabric is no longer doing its job.
For crypto lifecycle discipline, the broader key-management view matters too. NIST SP 800-57 Key Management is relevant because it treats key and certificate lifecycle as a governed process, including rotation and cryptoperiod decisions that affect operational resilience.
Public trust programs also depend on external rules for issuance and revocation discipline. The CA/Browser Forum is a useful reference point for how certificate issuance and revocation expectations shape trust, even though a smart city deployment may rely on private PKI for most internal communications.
What to verify before you trust the PKI model
Do not assume PKI is effective just because certificates exist. Verify that every important service is using the expected certificate chain, that renewal happens before expiry, that revocation is reachable where it matters, and that device or service onboarding cannot bypass the intended trust path. Also check whether certificate inventories, ownership, and expiry alerts are actually maintained.
The most revealing test is whether security and operations teams can explain how trust would recover after a failed certificate, a compromised key, or a CA problem. If recovery is slow, undocumented, or dependent on manual exceptions, the programme is operating with hidden fragility.
If you need a control baseline for access and authentication hygiene around this type of trust model, NIST SP 800-53 Rev 5 Security and Privacy Controls provides a useful control catalogue for authentication, access control, auditing, and configuration management.
Risk and Threat Considerations
Weak PKI in a smart city programme creates a trust problem that can quickly become an exposure problem. If certificate handling is inconsistent, an attacker does not need to break every system, only the trust assumptions connecting them. That can enable unauthorised access, service impersonation, or persistence through poorly managed certificates and keys.
Failure mechanism: Renewal gaps, inconsistent trust stores, weak revocation handling, or ad hoc authentication let systems continue operating on stale or unreliable trust decisions. That undermines the security boundary between devices and services and can turn a certificate mistake into a broader compromise path.
Impact: Services become harder to trust, incidents take longer to contain, and operational failures can spread across connected city services. In practice, that means more downtime, more exposure to unauthorised access, and less confidence that the environment can recover cleanly after a security event.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-57, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-57 | Key Management | PKI effectiveness depends on governed key and certificate lifecycle decisions. |
| Recommendation — Define key lifecycles, rotation timing, and recovery rules for all trust anchors. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate handling is part of authenticator lifecycle and renewal discipline. |
| IA-9 — Service Identification and Authentication | Smart city systems rely on service-to-service certificate-based trust. | |
| AC-17 — Remote Access | Distributed city systems need controlled trust paths for remote connections. | |
| Recommendation — Manage certificate issuance, renewal, revocation, and recovery as controlled authenticators. Require mutual authentication for system and service connections that carry city data. Restrict remote service access to authenticated, policy-approved trust paths. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Weak PKI often appears as inconsistent access enforcement across systems. |
| Recommendation — Continuously review and remove access paths that bypass the intended trust model. | ||
Practitioner Guidance
What to prioritise: Treat certificate inventory, renewal, revocation, and ownership as operational controls, not paperwork. If a team cannot show who owns each trust anchor and how expiry is handled before outage, the PKI programme is already at risk.
What to verify: Check for environments where services still work only because they accept manual exceptions, shared certificates, or inconsistent authentication paths. Those are the places where the trust model is most likely to fail first.
What practitioners underestimate: The hardest part is usually not issuing certificates, it is proving that the trust model still works after change, failure, or incident response. If recovery depends on heroics, the PKI is not mature enough for a large smart city deployment.
Practitioner takeaway: Effective PKI is visible in stable trust behaviour under change, not in the presence of certificates alone.
Related resources from NHI Mgmt Group
- What are the signs that a smart city programme is missing basic security controls?
- What are the signs that PKI is not being applied effectively in e-commerce environments?
- What are the signs that a national smart ID programme is not reducing identity fraud effectively?
- What are the signs that ENS controls are not being applied effectively across an organisation?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
