Certificate management remains one of the most overlooked attack surfaces in industrial cybersecurity, yet new research findings suggest the risk is far larger than most organizations realize. In this article, IIoT World examines research revealing that 18% of online certificates contain security vulnerabilities, a statistic with serious implications for industrial control systems, OT networks, and connected manufacturing environments. Readers will learn what types of certificate risks are most prevalent, why industrial organizations are disproportionately exposed, and what concrete steps security teams can take to identify and remediate certificate-based threats before they are exploited.
In a digital-first world, where billions of devices communicate securely through cryptographic keys and digital certificates, managing digital trust is more critical than ever. However, new research from Keyfactor has uncovered alarming security risks in 18% of all certificates used online, raising concerns about compliance failures, cyber threats, and overall security gaps.
Why This Matters
Every connected device—from manufacturing equipment to energy grids, cloud servers, and industrial control systems—relies on digital certificates to verify identity and secure communications. But with organizations managing hundreds of thousands of certificates, security gaps can easily form.
Keyfactor’s research highlights how certificate misconfigurations and cryptographic weaknesses can put enterprises at risk, making machine identity management a growing challenge for CISOs and security teams.
Key Certificate Risks Uncovered
Analyzing 500,000 online certificates, the research team identified several critical defects, including:
- Certificates with negative serial numbers – One in 27 certificates had a non-positive serial number, affecting trust validation.
- Certificates with long lifespans – One in 13 certificates had a lifespan exceeding two years, increasing security risks.
- Large certificate file sizes – Many certificates exceeded 100kB, making them incompatible with default system settings, leading to validation failures.
- No key usage defined – One in 29 certificates lacked key usage specifications, meaning they could be misused for unintended purposes.
- CA certificates without basic constraints – One in 32 certificates were issued by a Certificate Authority missing Basic Constraints, weakening trust hierarchies.
When extrapolated to the 8 billion known certificates online, these findings reveal millions of vulnerable digital certificates, increasing the likelihood of security breaches, operational failures, and compliance violations.
How CISOs and Security Teams Can Mitigate These Risks
To combat these certificate vulnerabilities, organizations must take a proactive approach to certificate management, including:
- Continuous discovery and monitoring – Automatically identifying and tracking all certificates in use.
- Automated certificate lifecycle management – Ensuring timely renewal and revocation of weak or expired certificates.
- Strict policy enforcement – Implementing best practices for cryptographic strength, key usage, and compliance.
- Risk-based certificate management – Prioritizing certificate remediation based on real-time risk scoring.
With the upcoming launch of Keyfactor Command Risk Intelligence, organizations will gain unmatched visibility into certificate vulnerabilities, allowing CISOs and security teams to proactively manage risks before they escalate.
Final Thoughts
Digital trust is the backbone of secure industrial and enterprise ecosystems. As cyber threats evolve, certificate misconfigurations and weak cryptographic practices can create hidden security gaps. This research underscores the urgent need for organizations to strengthen their certificate management strategies to prevent breaches, maintain compliance, and uphold trust across their digital environments.
To read more, access the full report here: https://www.keyfactor.com/command-risk-intelligence-report/
Related articles:
- IIoT World Days 2025: What’s Next in IIoT, AI & Cybersecurity?
- Fortinet OT Security Summit: Strengthening Cybersecurity for Critical Infrastructure
FAQ Section
1. Why are certificate security risks especially dangerous in industrial control systems?
Industrial control systems (ICS) and operational technology (OT) environments often rely on certificates for machine-to-machine authentication, encrypted communications between PLCs and SCADA systems, and secure remote access. When 18% of certificates contain vulnerabilities, it means a significant portion of these trust-based connections could be compromised. Unlike IT environments where certificate rotation is routine, many ICS deployments use long-lived certificates that may go years without review. A compromised certificate in an ICS context can enable man-in-the-middle attacks, unauthorized device access, or data exfiltration from critical production systems.
2. What are the most common types of certificate security risks found in the research?
The most frequently identified risks include expired certificates still in active use, certificates signed with weak or deprecated cryptographic algorithms such as SHA-1, misconfigured certificate chains that fail proper validation, and wildcard certificates that grant overly broad access across multiple subdomains. In industrial settings, self-signed certificates are particularly prevalent because they are easy to deploy during initial system commissioning but rarely get replaced with properly issued certificates. Each of these risk categories creates a distinct attack vector that threat actors can exploit to gain unauthorized access or intercept sensitive operational data.
3. How can manufacturing organizations improve their certificate security posture?
Organizations should begin with a comprehensive certificate inventory across both IT and OT environments, as many industrial networks contain certificates that were deployed years ago and have no documented owner. Automated certificate lifecycle management tools can flag upcoming expirations and weak algorithms before they become exploitable. Implementing certificate transparency logging helps detect unauthorized certificate issuance for your domains. For ICS-specific environments, segmenting certificate authorities between IT and OT and enforcing shorter certificate lifespans, ideally under 12 months, significantly reduces the window of exposure.
Related from IIoT World:
