CLM provides transparency for digital certificates and reduces security risks

Digital certificates are the invisible foundation of modern IT infrastructures. They enable encrypted communication, authenticate systems, and build trust between applications, devices, and services. At the same time, managing them is becoming increasingly complex:

• The number of certificates is rising sharply; in some companies, the number of machine identities is already 60 times higher than that of human identities.
• Their validity periods are shrinking significantly; in 2018 it was two years, today 200 days, and by 2029 it will be just 47 days.
• Regulatory requirements for control and traceability are increasing.
• The transition to post-quantum cryptography will require the replacement of thousands of certificates.

For IT departments, this means more work and a growing risk of security vulnerabilities. An expired certificate can block access, cripple applications, disrupt business processes, and — in the worst-case scenario — increase a company’s attack surface. Swiss Post Cybersecurity addresses these challenges with its automated Certificate Lifecycle Management (CLM). The solution provides transparency into all certificates and automates recurring processes.

“Certificates are among the things in IT that should function as invisibly as possible. If a team has to regularly check whether a certificate is about to expire somewhere, that’s a sign that too much is being done manually,” says Paul Such, CEO of Swiss Post Cybersecurity. “With Certificate Lifecycle Management, companies regain control over their certificate landscape — before expired, misconfigured, or non-compliant certificates jeopardize operations.”

A Centralized Overview Instead of Certificate Chaos

Swiss Post Cybersecurity’s CLM solution tracks certificates across different architectures, consolidates them into a central inventory, and can leverage existing PKIs. This gives IT teams an overview of

• which certificates are available and where they are being used
• who owns them and who is responsible for renewal
• when they expire
• and where action is needed (compliance, weak algorithms).

Risks such as unauthorized certificate authorities or violations of defined policies can be identified early on.

CLM automates the entire lifecycle — from issuance through renewal to revocation. This reduces repetitive tasks and eliminates sources of error. Notifications, defined policies, and automated workflows ensure that certificates are not only addressed after a system outage has already occurred.

Thorough Preparation for Audits and Compliance Reviews

Certificates are an integral part of the security architecture and are therefore increasingly becoming a governance and compliance issue. Centralized inventory management and traceable administration help companies control their assets and better meet audit requirements.

The solution from Swiss Post Cybersecurity offers features in the areas of auditing, governance, and automation. This allows organizations to define responsibilities and permissions, map approval processes, and enforce policies. For companies subject to regulatory requirements such as NIS2 or DORA, structured certificate management thus becomes a critical component of their security organization.

European Technology, Swiss Operations

Swiss Post Cybersecurity’s CLM solution is based on the platform from Evertrust, a French provider of cybersecurity solutions trusted by SwissSign; Swiss Post Cybersecurity has been an authorized implementation and hosting partner since May 2026. The CLM instances are hosted on Swiss Post Cybersecurity’s private infrastructure in Switzerland.

Definition of CLM:

Certificate Lifecycle Management refers to the centralized management of digital certificates, from issuance through monitoring and renewal to expiration or revocation. The goal of CLM is to eliminate the need for manual certificate management and instead manage certificates centrally, automatically, and according to defined rules throughout their entire lifecycle.