NIST recommendations for TLS Server Certificate Management: An Overview

by Allan Roy on June 26, 2020

The National Cybersecurity Center of Excellence (NCCoE), member of the National Institute of Standards and Technology (NIST), introduced a publication as part of their Cybersecurity Practice Guide series. “Securing Web Transactions: TLS Server Certificate Management” is designed to help members of the cybersecurity community understand the challenges of certificate management and adopt best practices when designing procedures to generate, monitor and manage certificates for the enterprise.

The document is user-friendly and offers practical guidelines that would keep cybersecurity practices in the pink of health. In the introductory chapters, the the primary uses of Transport Layer Security (TLS) certificates to secure both customer-facing and internal applications are described; the relationship between the certificate and its corresponding key is explained; and several challenges that security teams face while establishing, assigning, changing, maintaining and managing certificates are touched upon.

The guide highlights the fact that while medium and large organizations typically have many system administrators, most have only a handful of people on the PKI team, creating a set of risks and challenges – including frequent application outages due to expired TLS server certificates, security risks from fraudulent certificates, and disaster recovery challenges when organizations are required to quickly change large numbers of certificates.

The TLS Server Certificate Management Project, described in the guide, offers several solutions to these challenges, which are primarily focused on establishing central governance over certificate management, keeping accurate inventory, introducing standardized automated certificate installation practices, and continuously monitoring and managing certificates for expiration, proper operation, and security issues. Not only do these best practices help minimize overhead and reduce human error, they can reduce the occurrences of security incidents resulting from improper certificate management and maintenance. In short, adopting a standardized, automated process for managing the entire certificate lifecycle can help boost security, improve IT environments, and reduce risks.

Sponsorships Available

AppViewX offers a market-leading certificate management platform that enables automation of all phases of the certificate lifecycle. Using custom, policy-controlled event-driven workflows, PKI teams can discover, create, renew, provision, and revoke certificates and keys in multi-cloud, multi-vendor environments. AppViewX’s low-code solutions allow other teams in the organization to launch automated workflows to suit their needs, accelerating release cycles and reducing downtime. Most importantly, AppViewX’s certificate lifecycle management solution is context-aware, allowing security teams to instantly view the configuration, state, and performance of their infrastructure, trigger automated workflows based on changes in the network infrastructure and initiate automated workflows from context-rich and actionable dashboards.

Learn more about the AppViewX CERT+ certificate lifecycle management solution, and see how it can help you bring your organization’s certificate management policies in line with the NCCoE recommended best practices.

Feel free to reach out to us to set up a 30-minute exploratory session where our experts will identify areas of improvement in your PKI management system, and tell you exactly how we can help to improve it.

The post NIST recommendations for TLS Server Certificate Management: An Overview appeared first on AppViewX.