Scalable PKI Services for Zero Trust in 2026

The short answer

Zero trust requires every user, device, workload and application to prove its identity before accessing a resource. Public Key Infrastructure is what makes that proof possible at machine speed, which means the scale of a zero trust programme is limited by the scale of the PKI underneath it.

Most enterprise PKI was designed for a smaller, more predictable estate. When it is asked to support continuous verification across cloud platforms, containerised workloads and distributed devices, four constraints surface:

1. Certificate volume. Zero trust multiplies the number of identities requiring certificates, and manual issuance processes cannot absorb the increase.
2. Visibility. Certificates issued outside a central process cannot be governed, and unknown certificates are the most common cause of outage.
3. Renewal frequency. Public TLS certificate lifetimes are contracting towards 47 days by March 2029, which removes manual renewal as a viable option.
4. Integration. PKI that does not connect to identity management, monitoring and deployment pipelines creates blind spots that undermine continuous verification.

Addressing these requires automation, centralised visibility and a hierarchy designed for the estate as it will be rather than as it was. This article sets out what that involves and how Unsung supports organisations through it.

Why PKI determines the scale of a zero trust programme

Zero trust operates on the principle that trust is earned and verified rather than inherited from network location. Every access decision depends on establishing who or what is making the request, and on protecting the data exchanged once that decision is made.

Digital certificates provide both. They authenticate devices and workloads that have no human operator to present credentials, they encrypt data in transit, and they support the continuous verification that separates zero trust from perimeter-based security. An organisation can define zero trust policy without PKI, but it cannot enforce it across machine identities at enterprise scale.

The practical consequence is that PKI capability sets the ceiling on zero trust ambition. Where certificate issuance takes days and depends on a ticket queue, workloads cannot be verified continuously because the infrastructure cannot issue and rotate credentials quickly enough. Where certificate inventory is incomplete, policy cannot be enforced consistently because parts of the estate are invisible to it.

Our article on the role of PKI in Zero Trust security strategies examines that relationship in more depth.

Where enterprise PKI comes under strain

Research published by the Ponemon Institute has consistently pointed to the same pressures across large organisations. Internal certificate populations now run into six figures for many enterprises, with an average approaching 115,000 internal certificates reported in its enterprise PKI research. Fewer than half of respondents rated their PKI as highly effective for meeting compliance requirements.

The barriers reported most frequently are misconfiguration within PKI infrastructure, unplanned outages caused by expired certificates, and limited visibility of certificate inventory. Each of these becomes more acute under zero trust, because the model increases certificate requirements across every segment of the network rather than concentrating them at the perimeter.

Three underlying causes account for most of it.

Architecture designed for a different estate. Hierarchies built a decade ago were sized for user certificates, web servers and network devices. They were not sized for container orchestration platforms issuing short-lived identities at high frequency.

Absence of native automation. Legacy platforms frequently lack support for the enrolment protocols modern workloads expect, which forces teams into scripting and manual intervention that neither scales nor audits well.

Fragmented ownership. Where certificates are issued by several teams using different standards, key lengths and certificate authorities, no single view of the estate exists.

Our article on why traditional certificate management is no longer enough sets out how these pressures typically present.

How certificate sprawl undermines zero trust

Certificate sprawl occurs when certificates proliferate across environments without centralised management. Development teams obtain certificates from public certificate authorities to unblock a deployment. Cloud platforms issue their own. Self-signed certificates are created for internal testing and quietly remain in production.

The security consequence is that the unified trust model zero trust depends upon becomes fragmented. Policy cannot be applied to certificates the organisation does not know exist. Expired certificates cause outages that present as application faults, which delays diagnosis. Certificates issued outside governance may carry inappropriate validity periods, weak key lengths or capabilities the use case never required.

Addressing sprawl requires three things working together. Automated discovery across networks, cloud provider APIs, certificate authority databases and container platforms establishes what exists. Centralised certificate lifecycle management provides ownership, renewal orchestration and consistent policy. Governance defines who may request certificates, who approves them, and which profiles are permitted for which purpose.

The order matters. Governance applied to an unknown estate produces policy that cannot be enforced.

Why automation becomes mandatory rather than desirable

The CA/Browser Forum has approved ballot SC-081v3, which introduces a phased reduction in maximum TLS certificate validity. By March 2029, the maximum lifetime for publicly trusted TLS certificates reaches 47 days, with domain validation reuse periods reducing to ten days over the same schedule. An organisation renewing manually would face renewal cycles more than eight times a year for every publicly trusted certificate it holds.

Internal certificate populations face a parallel pressure from growth rather than regulation. Containerised workloads, service meshes and machine identities multiply the number of certificates in issue, and many of those identities are short-lived by design.

Automation addresses both. Enrolment protocols including ACME, SCEP, EST and CMP allow endpoints to request and renew certificates without human involvement. Our comparison of certificate management protocols covers where each is appropriate.

Automation also changes what is possible operationally. Certificates can be provisioned as applications deploy, rotated frequently enough to limit the value of a compromised key, and revoked rapidly when an incident requires it. Those capabilities support zero trust directly.

Resistance to automation is common and usually rooted in reasonable concerns about losing control of issuance. Our article on overcoming resistance to automation in certificate management addresses how those concerns are best handled during a programme.

Designing PKI architecture for zero trust

Effective design begins with understanding the certificate requirement across every environment. Mapping the devices, workloads, applications and users that require authentication reveals both the scale of the estate and the gaps in current coverage. This discovery frequently produces the first accurate picture an organisation has held of its own cryptographic footprint.

A hierarchy suited to zero trust typically separates an offline root certificate authority from multiple online issuing certificate authorities. That separation protects the trust anchor while allowing issuance to be segmented by environment, application type, business unit or geography. Segmentation matters under zero trust because it limits the consequences of compromise and allows different policy to apply to different populations.

Integration determines whether the architecture works in practice. PKI needs to connect to identity and access management systems, directory services, security monitoring platforms and the deployment pipelines that consume certificates. Where those connections are absent, certificate operations happen outside the visibility of the security function.

Our PKI design and build service covers hierarchy design, certificate profiles, enrolment protocols and the governance framework that supports them.

Understanding the relationship between PKI and CLM

PKI establishes the trust framework. It defines the certificate authorities, the policies that govern issuance, the key protection model and the hierarchy through which trust flows.

Certificate lifecycle management is the operational capability that keeps that framework functioning. It handles discovery, issuance, renewal, revocation and monitoring, and it provides the visibility that tells an organisation the status of every certificate it holds.

Both are required. A well-designed PKI operated through manual processes will accumulate expired certificates, inconsistent policy application and compliance gaps. A CLM platform deployed over a poorly designed hierarchy will automate the distribution of certificates that should not have been issued in that form.

Our certificate lifecycle management service addresses both dimensions, and our guide to the four pillars of CLM sets out the capabilities that matter most.

Integrating PKI with identity management

Zero trust requires machine identity and human identity to be governed coherently. Certificates authenticate devices and workloads, while the identity provider manages users and access policy. Where the two operate independently, policy decisions are made against partial information.

Modern PKI should support integration with Active Directory, Entra ID and other identity providers through standard protocols. That enables certificate-based authentication for users, automated provisioning for managed devices, and coordinated policy enforcement across both identity types.

Active Directory Certificate Services environments warrant particular attention here, since template and enrolment misconfigurations in ADCS can permit privilege escalation from an ordinary user account. Our article on Active Directory Certificate Services in modern IT covers the operational and security considerations.

The components of enterprise PKI for zero trust

Certificate authorities and trust hierarchies

Certificate authorities issue and manage certificates, with the root certificate authority serving as the trust anchor for the hierarchy. Subordinate authorities issue for specific purposes, allowing trust to be segmented and certificate management delegated appropriately.

Hierarchy design affects security, scalability and operational flexibility. A single-tier architecture concentrates risk and becomes a bottleneck as volumes increase. Multi-tier architectures distribute issuance and contain the impact of any single compromise.

Regulated sectors frequently carry specific requirements. Government and defence organisations often operate under configuration constraints driven by classification or policy, and our work across central government and defence reflects those obligations.

Hardware security modules for key protection

Hardware security modules protect the private keys that anchor trust. Keys generated and held within an HSM cannot be extracted through software attack, which matters most for root and issuing certificate authority keys where compromise would undermine the entire hierarchy.

Selection depends on security requirements, deployment model and compliance obligations. FIPS 140-3 validation and Common Criteria certification provide independent assurance that a module meets defined standards, and organisations operating older estates should confirm whether their modules hold current validations or legacy FIPS 140-2 certificates.

Unsung works with hardware security module vendors including Thales and Crypto4A, and our recommendations reflect the requirement rather than a platform preference. Our hardware security modules service covers selection, deployment, key ceremony procedure and integration.

Certificate lifecycle management platforms

CLM platforms automate discovery, issuance, renewal and revocation across the estate, replacing manual tracking with centralised visibility.

Effective platforms integrate with multiple certificate authorities, support public and private certificates, and connect to the tools teams already use. Integration with deployment pipelines allows provisioning during application deployment, and integration with monitoring provides warning before expiry.

Selection requires evaluating the current environment, anticipated volumes and integration requirements. Our guidance on how to evaluate CLM vendors and licensing models and what to look for inside an enterprise CLM deployment set out the criteria that matter.

Aligning PKI operations with zero trust principles

Least privilege in certificate management

Role-based access control ensures that certificate requesters, approvers, administrators and auditors each hold permissions appropriate to their responsibilities. Workflow-based approval adds accountability, with high-value certificates and changes to certificate authority configuration requiring multiple authorisations.

Audit logging should capture every action, providing the evidence trail required for compliance reporting and incident investigation.

Least privilege extends to the certificates themselves. A certificate granting broader capability than the use case requires creates risk that persists for the life of the certificate. Certificate profiles should be defined narrowly and reviewed periodically.

Monitoring and continuous verification

Zero trust depends on ongoing monitoring rather than periodic assessment. PKI should generate real-time data on certificate status, usage patterns and configuration compliance, feeding into the same security monitoring platforms that handle other event sources.

Monitoring should cover expiry, revocation status, configuration drift and anomalous issuance. Tiered alerting prevents both alert fatigue and missed renewals, with different thresholds for a certificate expiring in thirty days and one expiring in seven.

Periodic assessment remains valuable alongside monitoring. A PKI health check examines architecture, governance and operational maturity in a way continuous monitoring does not, and produces a prioritised remediation position.

Choosing an operating model

Organisations have several options for operating PKI, and the right choice depends on internal expertise, resource availability, security requirements and tolerance for operational risk.

Operating PKI well requires specialist knowledge, continuous monitoring and disciplined adherence to security and regulatory standards. Many organisations dedicate a small number of staff to PKI alongside other responsibilities, and Ponemon research has reported that fewer than half of organisations consider their in-house expertise sufficient.

Managed services transfer operational responsibility to specialists while the organisation retains control of policy and full visibility of operations. Our PKI management and hosting service operates environments under agreed service levels for government and private sector clients, including defence and national infrastructure programmes.

Cloud, on-premises and hybrid deployment models each suit different circumstances. Cloud offers scalability and reduced infrastructure overhead. On-premises provides maximum control and is frequently required where data residency or classification constraints apply. Hybrid models combine the two, commonly with root certificate authorities held on-premises and issuing authorities operating in cloud environments.

Preparing PKI for post-quantum cryptography

The algorithms that secure certificates today will eventually be vulnerable to cryptographically relevant quantum computers. Preparing for that transition while modernising for zero trust avoids doing the work twice.

Crypto agility is the ability to change cryptographic algorithms without redesigning the infrastructure. It requires certificate profiles that support multiple algorithm types, key management processes that accommodate different algorithms and key sizes, and integration points that do not depend on a specific cryptographic implementation. Our article on what crypto agility actually means in practice examines the operational detail.

The timeline is becoming clearer. NIST has published its initial post-quantum standards, and NIST Internal Report 8547 proposes deprecating RSA and elliptic curve cryptography from 2030 and disallowing them from 2035. In the UK, NCSC guidance expects organisations to complete discovery and planning by 2028, high-priority migration by 2031, and full migration by 2035. Our overview of the NIST post-quantum roadmap covers the standards position in more detail.

Practical preparation begins with inventory. A Cryptographic Bill of Materials catalogues every cryptographic asset across the estate, identifying where vulnerable algorithms are in use and which systems will require change. Pilot migrations in controlled environments then reveal integration and performance characteristics before production deployment. Our article on five practical steps to PQC readiness sets out what can be achieved without significant investment.

Evaluating PKI solutions

Selection should be driven by fit with the existing environment and the operating model, since integration capability and long-term scalability usually determine success more than any individual feature.

Scalability should be assessed against current volumes and projected growth, including the certificate types required across TLS, code signing and device identity.

Automation capability determines operational efficiency at scale. Automated discovery, issuance, renewal and revocation, together with integration into identity management, deployment pipelines and monitoring platforms, are the capabilities that matter.

Compliance support reduces manual effort in regulated environments. Built-in audit reporting and documentation shorten the work required to demonstrate conformance.

Unsung is a specialist consultancy rather than a reseller. Our PKI consultancy team holds experience across multiple platforms, and our recommendations are shaped by client requirements rather than vendor relationships.

Measuring PKI effectiveness

Three measures give a reliable picture of whether a programme is working.

Certificate-related outages, measured by frequency and duration, indicate operational effectiveness. Effective automation and visibility should reduce both over time.

Inventory accuracy measures how well the organisation understands its own estate. The proportion of certificates with a known owner and a known renewal path is a practical indicator of governance maturity.

Audit outcomes, tracked through findings, remediation timelines and repeat findings, demonstrate whether governance is improving.

Building PKI that supports zero trust at scale

Zero trust depends on the ability to verify identity continuously across an estate that grows and changes constantly. That capability rests on PKI that can issue, renew and revoke at the pace the environment demands, with visibility across every certificate in use.

The organisations that achieve this invest in three things together. Automation to handle volume and renewal frequency. Centralised visibility to remove blind spots. Expertise to design and operate the infrastructure, whether developed internally or engaged externally.

Unsung is a UK-based specialist consultancy focused entirely on Public Key Infrastructure, working with government and enterprise organisations across defence, financial services, healthcare, transport and critical national infrastructure. We are vendor-neutral, and our recommendations reflect your requirements rather than a platform roadmap.

Contact us to discuss how your PKI supports your zero trust objectives.

‍