PKI becomes harder to scale when certificate volume rises faster than process maturity. The survey links growth in PKI usage to new enterprise applications and IoT use cases, while many respondents also point to excessive manual processes. That combination increases operational friction, delays renewals, and makes it harder to maintain consistent trust, visibility, and lifecycle control across environments.
Why PKI stops being simple when certificate demand spikes
PKI scales poorly when the number of certificates, renewals, and trust relationships grows faster than the organization’s operating model. New applications and IoT deployments increase the number of endpoints that need issuance, renewal, revocation, policy enforcement, and inventory accuracy. If those tasks still depend on manual coordination, the result is queueing, inconsistency, and avoidable outages.
At small scale, teams can track exceptions informally. At larger scale, the same approach turns certificate management into a production dependency that is easy to miss until expiry, mis-issuance, or trust drift appears. The issue is less about the cryptography itself and more about whether the surrounding process can keep pace with demand.
As Machine Identity, PKI and Certificate Lifecycle Guide explains, certificates are a machine identity control as much as a trust artifact, so scale pressure shows up first in lifecycle handling. CA/Browser Forum baseline requirements also illustrate why short-lived certificates and stricter issuance practices raise the operational bar for renewal automation.
What changes when applications and IoT expand the trust surface
Every new application, device, service, or embedded system adds another certificate consumer and another renewal path. That expansion creates a wider trust surface, more policy variation, and more chances for one environment to drift from another. IoT often makes this worse because devices can be deployed in large numbers, sit outside normal endpoint management, and use certificate renewal patterns that are harder to observe centrally.
The practical consequence is not just more work, but more variation. Different teams may request certificates through different channels, use different profiles, or rely on different monitoring tools. Once the estate fragments, it becomes harder to answer basic questions such as which certificates exist, who owns them, when they expire, and whether the right policy is still attached.
NIST SP 800-57 Key Management is useful here because the control problem is lifecycle discipline, not just key strength. The more endpoints and trust domains you have, the more important it becomes to keep issuance, rotation, revocation, and algorithm decisions predictable.
Where manual PKI operations create the most friction
Manual PKI processes break down first at renewal, exception handling, and revocation. Renewal is time-sensitive, so a missed handoff can turn into service interruption even when the underlying certificate is valid in principle. Revocation is similarly hard to scale because it depends on timely detection, ownership clarity, and distribution of trust-state changes across consuming systems.
Manual work also creates hidden risk in approval and inventory. If teams cannot reliably confirm which certificates are active, they may over-issue, duplicate, or leave stale certificates in place longer than intended. That slows incident response and makes it harder to prove that trust boundaries are still being enforced consistently.
NIST SP 800-53 Rev 5 Security and Privacy Controls maps well to this problem because PKI scale depends on access control, configuration management, and auditability working together rather than as separate checks. NIST Cybersecurity Framework 2.0 is also relevant for the governance and recovery angle, especially where certificate failures can affect multiple services at once.
Risk and Threat Considerations
PKI scale failures are dangerous because they often present first as reliability problems, then become security problems. A missed renewal can cause outage, but a weak inventory or slow revocation process can also leave compromised or stale certificates trusted longer than intended, which increases the window for abuse.
Failure mechanism: Growth in certificate volume outpaces automation, ownership, and monitoring, so expiry, revocation, or policy drift is not detected or acted on in time.
Impact: Services fail unexpectedly, trust is applied inconsistently across environments, and attackers or insiders can benefit from stale or mismanaged certificate state.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-57, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-57 | Key Management Recommendations | PKI scaling depends on lifecycle and cryptoperiod discipline for keys and certificates. |
| Recommendation — Standardize key and certificate lifecycle rules so renewal and rotation remain predictable at scale. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate environments need controlled issuance, rotation, and revocation processes. |
| CM-2 — Baseline Configuration | PKI growth across applications and IoT requires consistent certificate profiles and approved configurations. | |
| Recommendation — Automate credential lifecycle handling so certificate renewal and revocation do not depend on manual steps. Define and enforce standard certificate profiles to reduce drift across expanding deployments. | ||
| NIST CSF 2.0 | GV.SC-01 — Supply Chain Risk Management Strategy | PKI expansion across applications and IoT introduces dependency and third-party trust governance concerns. |
| Recommendation — Inventory and govern certificate dependencies so trust changes do not create unmanaged operational risk. | ||
Practitioner Guidance
What to prioritise: Treat certificate lifecycle ownership as the scaling constraint, not the CA itself. Before adding more applications or IoT devices, verify that issuance, renewal, revocation, and inventory are all automated enough to survive growth without manual rescue.
What to verify: Confirm that every certificate has a named owner, an expiry alert path, and a renewal method that works without ad hoc intervention. If you cannot answer those three questions quickly, the PKI estate is already larger than the operating model can support.
Common mistake: Teams often focus on obtaining certificates quickly and underinvest in renewal discipline. That works until certificate count grows, at which point the organization discovers that trust maintenance, not initial issuance, is the real bottleneck.
Practitioner takeaway: PKI scales when lifecycle handling is engineered as a repeatable service, with automation, inventory, and ownership keeping pace with certificate growth.
Related resources from NHI Mgmt Group
- Why does expanding PKI into new use cases increase governance and delivery risk?
- How should security teams evaluate PKI platforms for mixed enterprise, cloud, and IoT use cases?
- How should security teams govern non-human identities at scale?
- How should organizations prioritize environments for NHI management?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
