Enterprise PKI and Certificate Management: Preventing Outages and Stopping Certificate-Based Attacks
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
TLS certificates are the cryptographic foundation of encrypted communications — every HTTPS connection, every API call over TLS, every VPN endpoint, every internal service with encrypted traffic requires a certificate with a limited validity period. When a certificate expires, the service it protects either becomes unreachable (browsers refuse connections) or presents an error that breaks integrations.
Managing certificates manually — tracking expiry dates in a spreadsheet, manually renewing before expiration, distributing updated certificates to all endpoints — fails reliably at scale. Enterprises with hundreds of services, multiple business units, and accelerated certificate validity timelines (the industry is moving from 1-year to 47-day maximums) need automated certificate lifecycle management.
This guide covers the architecture of enterprise certificate management: discovery, inventory, automated renewal with ACME, PKI hierarchy design, and the security controls that prevent certificate abuse.
Certificate discovery: finding what you do not know you have
Before you can manage certificates, you need to know all the certificates in your environment. Discovery consistently reveals 2 to 3 times more certificates than the team believes exist, because shadow certificates issued by developers, cloud teams, and business units without informing the central security team are common. These undiscovered certificates expire with no monitoring or alerting, producing surprise outages. Discovery has two distinct scopes: external certificates visible in public Certificate Transparency logs, and internal certificates issued by private CAs that only network scanning can surface. Both require separate tooling and processes.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
ACME protocol: eliminating manual certificate renewal
The ACME (Automatic Certificate Management Environment) protocol, standardized as RFC 8555, automates certificate issuance and renewal without human intervention. It is the technical foundation of Let's Encrypt and is now supported by all major commercial CAs including DigiCert, Sectigo, and GlobalSign. ACME works by automating the domain ownership validation step that CAs require before issuing a certificate, using either an HTTP challenge or a DNS challenge. With ACME configured, certificates renew automatically on a scheduled basis before expiry, eliminating the human-driven renewal process that fails at scale. As maximum certificate validity shrinks toward 47 days, ACME is no longer a convenience but a prerequisite for operational reliability.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
PKI hierarchy design for enterprises
Organizations issuing significant volumes of internal certificates need a PKI hierarchy rather than purchasing individual certificates from public CAs for every internal service. A properly designed hierarchy consists of an offline root CA that signs intermediate CAs, and online intermediate CAs that perform day-to-day issuance. This architecture limits the blast radius of a compromise: if an intermediate CA is breached, only certificates from that CA are affected, while the root and other intermediates remain valid. PKI hierarchy design also involves certificate policy, which defines what each CA is authorized to issue and for which domains. Without policy enforcement, a single compromised CA can issue certificates that impersonate any service in the organization.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Certificate security controls: preventing abuse
Certificate management is not only about uptime. Incorrectly issued or compromised certificates are an attack vector: an attacker with a legitimately issued certificate for your domain can intercept traffic in a MITM attack that bypasses TLS validation entirely. Three controls address certificate abuse: CAA DNS records that restrict which CAs can issue certificates for your domains, certificate pinning for the highest-value internal services, and continuous CT log monitoring that detects unauthorized issuance within minutes of it occurring. Together these controls close the gap between certificate issuance and detection of unauthorized certificates.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
The bottom line
Certificate management is a reliability and security problem simultaneously. Automated renewal via ACME eliminates the human error that produces expiry-caused outages. Certificate discovery via CT logs and network scanning reveals the shadow certificates that expire without warning. A PKI hierarchy with offline root CA, policy-enforced intermediate CAs, and OCSP revocation infrastructure provides the foundation for internal certificate issuance at scale. CAA records and CT log monitoring prevent unauthorized certificate issuance. Together, these controls eliminate the most common certificate failure modes: surprise expiry outages and MITM attacks via unauthorized certificates.
Frequently asked questions
What happens when a TLS certificate expires in production?
When a TLS certificate expires, browsers display a certificate error page and refuse to continue without explicit user override. API clients configured to validate TLS certificates (the correct configuration) throw connection errors. Load balancers and reverse proxies may refuse to start or drop connections. Monitoring and alerting systems that check TLS endpoints may also fail. The practical impact: the service becomes unreachable for end users and automated systems simultaneously. Recovery requires: a new certificate issued and deployed to all endpoints serving that certificate — typically 1-4 hours with automation, potentially days without it if the certificate renewal process requires manual approval steps.
Should we use Let's Encrypt or a commercial CA for production services?
Let's Encrypt is appropriate for: most public-facing web services, APIs, and services where DV (Domain Validation) certificates are sufficient. Let's Encrypt certificates are trusted by all major browsers and operating systems. Commercial CAs are appropriate when: OV (Organization Validation) or EV (Extended Validation) certificates are required (certain regulated industries, high-value payment pages), your CA procurement and legal policies require vendor SLAs and commercial contracts, or your services require a CA that is not publicly accessible (internal services using a commercial enterprise CA). For most public-facing services, Let's Encrypt with ACME automation is the right choice — commercially equivalent security with no cost and automated renewal.
What is certificate transparency and why does it matter for security?
Certificate Transparency (CT) is a public audit log of all TLS certificates issued by publicly trusted CAs. Every certificate issued must be logged in CT logs; browsers reject certificates not present in CT logs. CT matters for security because: it makes unauthorized certificate issuance detectable (you can monitor CT logs for certificates issued for your domains), it enables historical analysis of certificate issuance (was a malicious certificate ever issued for your domain?), and it provides accountability for CAs (CA misissuance events are detectable and have led to CAs being distrusted). The CT ecosystem runs on transparency — the same logs that expose attacker-requested certificates also expose legitimate certificates, providing a complete picture of what has been issued for any domain.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.