Certificate governance is the controlled management of digital certificates and the public-key infrastructure behind them. It covers certificate issuance, approval, renewal, revocation, storage, and visibility over where certificates are installed and who can use them. In practice, this means knowing which systems trust which certificate authorities, which keys are protected by hardware or software controls, and when a certificate should be replaced or revoked.
It matters because certificates are the foundation of authentication, encrypted transport, and message integrity. Weak governance can lead to expired certificates, untracked self-signed certificates, stolen private keys, or rogue certificates that attackers use for impersonation, man-in-the-middle attacks, or fraudulent service endpoints. Strong governance helps defenders enforce trust boundaries with inventory, policy, short-lived certificates, automated renewal, revocation checks, and audit logging. In regulated workflows, such as secure evidence exchange, certificate governance also supports non-repudiation and a reliable chain of custody.