Unexpected expiry. A certificate expires without successful renewal or deployment, disrupting a critical service or dependency.
Why it matters
A small certificate can sit on a critical dependency path.
Certificates support far more than public websites. They can enable machine-to-machine authentication, APIs, VPNs, device identity, user authentication, code signing, document signing, email security and internal service trust. Failure can therefore affect confidentiality, integrity, authentication and availability.
NIST's TLS certificate management guidance describes certificate management as an enterprise programme problem: organisations need inventory, monitoring and lifecycle practices to prevent, detect and recover from certificate-related incidents. For risk management, the key question is not only whether a certificate is valid today, but whether its full dependency chain is understood and controlled.
The trust dependency
Understand what sits behind the certificate.
01Business serviceThe process or capability that relies on trusted communication, identity or signing.
02Application / endpointThe server, client, device, API, workload or signing service consuming the certificate.
03CertificateIdentity, public key, validity period, intended usage, issuer and algorithm information.
04Private keyThe protected key whose compromise can undermine the trust represented by the certificate.
05CA & trust chainIssuing and intermediate authorities, root trust anchors and relying-party trust configuration.
06Lifecycle processEnrollment, issuance, installation, renewal, rotation, revocation, replacement and retirement.
Risk lens
A certificate inventory becomes more valuable when it tells you not only what expires, but what business service fails, which key and CA are involved, who owns the dependency, and how quickly trust can be restored.
Certificate lifecycle
Risk exists across the full lifecycle.
NIST's certificate-management definition includes generation, storage, protection, transfer, loading, use and destruction, and its enterprise TLS guidance also emphasises inventory, monitoring, enrollment, installation and revocation. Risk management should therefore look beyond expiry alone.
01Request & enrollment
Who may request certificates, how identity and authorisation are validated, and whether approved profiles are enforced.
02Issuance & installation
Whether certificates are issued by approved authorities, configured correctly and associated with protected private keys.
03Use & monitoring
Whether active certificates, trust chains, algorithms, validity periods and configuration changes are continuously visible.
04Renewal & rotation
Whether renewal is timely, tested and preferably automated for high-volume environments, without creating hidden outages.
05Revocation & incident response
Whether compromised or invalid trust can be revoked and replaced quickly, with relying systems able to consume the change.
06Retirement
Whether obsolete certificates, keys, trust relationships and unused issuing paths are removed rather than left as unmanaged exposure.
Risk themes
What can go wrong?
Trust is no longer justified. If a private key is compromised, the corresponding certificate may need rapid revocation and replacement.
Unknown certificates. Certificates issued outside managed processes or embedded in forgotten systems can evade monitoring and governance.
CA dependency. A service may depend on an internal or external CA, intermediate chain or root trust store that is not fully understood.
Incorrect usage or weak profile. Certificate purpose, algorithm choices, key protection or trust configuration may not align with organisational standards.
Replacement is harder than expected. Legacy systems, vendor products, pinned certificates, embedded trust stores or manual processes can make change slow and risky.
Risk-management evidence
What should Information Security Risk Management expect to see?
Certificate inventory coverageVisibility across critical internal and external certificates, including ownership, purpose, issuer, expiry and consuming services.
Lifecycle ownershipClear accountability for request, renewal, revocation, deployment and incident response — including certificates managed by suppliers.
Expiry & renewal controlsMonitoring, alerting, renewal lead times, automation where appropriate, and evidence that replacement is deployed successfully.
Private-key protectionEvidence that key storage and access are appropriate to criticality and that compromise triggers defined response actions.
Trust-chain visibilityUnderstanding of issuing CAs, intermediates, roots, external trust providers and material dependencies on trust stores.
Exception managementKnown deviations from certificate or cryptographic standards with accountable owners, risk decisions and remediation dates.
Resilience testingEvidence that renewal, CA change, revocation and emergency replacement processes work for critical services.
Supplier readinessFor vendor-controlled certificates or platforms, clarity on lifecycle responsibility, supported algorithms and migration constraints.
Risk lens
Certificate expiry is visible and measurable, which makes it easy to focus on. But the deeper resilience question is whether the organisation can change trust safely when a key, CA, algorithm, vendor or standard changes unexpectedly.
Connection to quantum readiness
PQC will reach PKI through signatures, keys, certificates and trust ecosystems.
Post-quantum transition affects public-key mechanisms used for digital signatures and key establishment. NIST's current migration work therefore requires organisations to identify vulnerable public-key dependencies and plan technology updates rather than treating PQC as an isolated algorithm decision.
Certificate ecosystems may also need changes in profiles, credential containers, trust infrastructure, software and interoperability. NIST's 2026 PIV working drafts illustrate this broader impact: the proposed PQC updates consider new key references, certificate containers and data objects while supporting incremental transition and backward compatibility.
Questions to ask
Useful questions for risk conversations.
VisibilityCan we identify certificates supporting our critical services, including internally issued, externally issued and supplier-managed certificates?
OwnershipWho is accountable for each critical certificate and who is responsible for renewal, deployment and emergency replacement?
TrustWhich certificate authorities and trust anchors do critical services depend on, and are any outside our direct control?
Key protectionWhere are the corresponding private keys held and what happens if a key is suspected to be compromised?
ResilienceHow quickly could we revoke and replace a critical certificate without causing a prolonged outage?
Change readinessWhich systems or suppliers would constrain a change in certificate profile, CA, key type or cryptographic algorithm?
Authoritative sources
Further reading
NIST SP 1800-16Securing Web Transactions: TLS Server Certificate ManagementNIST CSRCCertificate Management — GlossaryNIST NCCoEMigration to PQC FAQ — Cryptographic Inventory and MigrationNIST CSRC · 2026 working draftsPQC Updates to the PIV Standards
This page synthesises public guidance for educational and risk-management purposes. Source documents should be consulted directly for normative, implementation-specific and sector-specific requirements.