A practical policy template for governing certificate ownership, issuance, renewal, revocation, cryptographic standards, inventory, monitoring, and accountability.
This policy is a starting point for organisations that need certificate management to work as an operational security capability rather than a collection of manual renewals. It should be adapted to local governance, risk appetite, PKI design, and tooling.
The policy defines the "what" and "why": which certificates are in scope, which controls are required, who owns the lifecycle, and how exceptions are handled.
This policy defines requirements for managing digital certificates used by the organisation. It applies to TLS/SSL server and client certificates, code signing certificates, S/MIME email certificates, device and IoT authentication certificates, and internal service or workload identity certificates.
The purpose is to protect service availability, encrypted communication, organisational identity, and trust relationships.
| Area | Policy requirement |
|---|---|
| Asymmetric algorithms | RSA 3072 bits or stronger; ECDSA secp384r1 or stronger; EdDSA where formally approved. |
| Hash algorithms | SHA-384 minimum for high-assurance profiles; SHA-256 only where compatibility requires it; SHA-1 prohibited for new issuance. |
| TLS configuration | Use approved protocol versions and cipher suites. Weak, deprecated, or export-grade cryptography must not be used. |
| Stage | Requirement |
|---|---|
| Issuance | Certificates must be issued only through approved certificate authorities or managed certificate services. CSRs must use approved procedures and accurate subject and SAN information. |
| Renewal | Renewal should begin at least 30 days before expiry unless a shorter automated lifecycle is deliberately designed and monitored. |
| Revocation | Certificates must be revoked when keys are compromised, certificates are issued incorrectly, services change, algorithms are deprecated, or certificates are no longer required. |
| Retirement | Retired certificates must be removed from systems and associated private keys securely destroyed or made unusable. |
A central certificate inventory must be maintained with certificate fingerprint, issuing CA, subject and SANs, associated service or domain, owner, environment, expiry date, renewal mechanism, and key protection method.
Certificate validity, expiry, configuration, and trust-chain health must be monitored. Reports should identify expired certificates, certificates expiring within 90, 60, and 30 days, weak algorithms, unknown certificates, and certificate-related incidents.
| Role | Responsibilities |
|---|---|
| Certificate Management / PKI Owner | Owns policy, standards, approved CAs, certificate profiles, reporting, and the operating model. |
| System and Application Owners | Own certificates used by their services and ensure renewal, deployment, and retirement are completed on time. |
| Security Operations | Monitors certificate-related alerts and supports investigation of suspicious or unauthorised certificates. |
| Infrastructure / Platform Teams | Operate tooling, automation, discovery, key stores, and certificate management platforms. |
Exceptions must be documented, risk assessed, approved, time-bound, and reviewed before expiry. The policy should be reviewed annually or after significant cryptographic standard updates.
NCSC Certificate Management Guidance, NIST SP 800-57, NIST SP 1800-16, NIST SP 800-131A, FIPS 140-3, ISO/IEC 27001:2022, PCI DSS v4.0, CA/Browser Forum Baseline Requirements, RFC 3161, and RFC 9162.