PKI key management is the discipline of generating, storing, rotating, protecting, and revoking the private keys that underpin certificate-based trust. Strong key management preserves cryptographic integrity across distributed environments and reduces the risk that poor custody, weak access control, or delayed rotation will undermine machine identity assurance.
Expanded Definition
PKI key management covers the full lifecycle of private keys used in certificate-based trust: generation, storage, distribution, rotation, backup, revocation, destruction, and recovery. In NHI environments, it is the operational layer that determines whether a certificate still represents a trustworthy machine identity or has become a lingering liability. The concept overlaps with certificate management, but it is narrower and more security-critical because the private key is the asset that must remain confidential even when certificates are public. Guidance varies across vendors on where key custody ends and certificate automation begins, so practitioners should treat the key itself as the control point and the certificate as the visible wrapper. For a standards-oriented baseline, the NIST Cybersecurity Framework 2.0 reinforces governance, protection, and recovery expectations that map well to key stewardship. The most common misapplication is treating certificate expiry as equivalent to key rotation, which occurs when teams renew certificates without replacing or revoking the underlying private key.
Examples and Use Cases
Implementing PKI key management rigorously often introduces operational overhead, requiring organisations to balance stronger trust assurance against automation complexity and outage risk.
- Rotating the private key behind an mTLS client certificate before its usage window becomes too long, as covered in the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs.
- Revoking a signing key after suspected compromise so downstream systems no longer trust artifacts signed with that key, a failure pattern echoed in the Coupang Signing Key Breach.
- Storing keys in hardened HSM-backed custody rather than embedding them in code, CI/CD variables, or shared filesystem paths, which aligns with the lifecycle controls in the NHI Lifecycle Management Guide.
- Automating renewal while preserving separate approval logic for new key material, because a fresh certificate on an old key does not materially improve assurance.
- Documenting emergency revocation procedures so certificate authorities, internal trust stores, and dependent services can respond consistently when a key is exposed.
Why It Matters in NHI Security
PKI key management matters because machine trust collapses quickly once private keys are copied, stale, or broadly accessible. In NHI environments, certificates often authenticate service accounts, workloads, APIs, and signing pipelines, which means weak key custody can become lateral movement, impersonation, or fraudulent software release. NHI Mgmt Group research shows that 71% of NHIs are not rotated within recommended time frames, a signal that key lifecycle discipline is often weaker than the trust it is meant to protect. That gap becomes especially dangerous when keys live longer than the workload, when revocation does not reach all relying parties, or when backups preserve compromised material indefinitely. These risks are not theoretical: the same operational failures that create secret sprawl also undermine PKI assurance, especially in distributed and multi-team environments. The Ultimate Guide to NHIs — Regulatory and Audit Perspectives and the Top 10 NHI Issues both emphasize that visibility and lifecycle controls are inseparable from trust. Organisations typically encounter key management as an urgent issue only after a compromise, expired trust chain, or signing incident, at which point PKI key management becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207), NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers secret and key handling failures that weaken NHI trust chains. |
| NIST CSF 2.0 | PR.AC-1 | Identity and access protections include strong custody of cryptographic keys. |
| NIST Zero Trust (SP 800-207) | SP 800-207 | Zero Trust depends on continuous trust decisions backed by strong machine identity. |
| NIST SP 800-63 | AAL2 | Assurance guidance informs the strength expected for authenticated identities and credentials. |
| NIST AI RMF | GV.1 | Governance requires defined accountability for cryptographic and identity risk controls. |
Treat private keys as privileged assets and restrict access to only approved custodians and workloads.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
