Defense
№ 013 · class: identity / access
Certificate Management
Managing the lifecycle of digital certificates — issuance, renewal, revocation.
Term
description · examples · notesManaging the lifecycle of digital certificates — issuance, renewal, revocation.
Description
Covers TLS/SSL certificates, code signing certificates, and client certificates.
Automation prevents service outages due to expired certificates.
PKI infrastructure control reduces the risk of MitM attacks.
Includes monitoring third-party certificates and wildcard certificates.
What people often say
- HTTPS does not mean a site is safe — phishing sites also use TLS.
- Wildcard certificates are not always good practice as compromise covers all subdomains.
Covers / does not cover
Covers
- TLS/SSL management
- Automated renewal (ACME/Let's Encrypt)
- Expiration and revocation monitoring
Does not cover
- Data-at-rest encryption
- SSH key management (separate)
- User authentication (that is IAM)
Threats
reduces 3Threats it reduces. Select one to open its page.
Techniques
neutralizes 2Techniques it neutralizes. Select one to open its page.