What the attacker wants
PKI attackers (and confused deployments) treat client certificates as ambient API keys: present the cert, call forever. The estate question is whether transport identity and request authority are the same object.
Attacks · By business pattern
PKI coexistence
Keep certificates; fix request authorization separately. PKI still authenticates channels and devices — one-shot proofs authorize the request without turning certs into ambient API keys.
~5 min readDeep-link: Ambient credentials
Opening
How it works today
Certificates are excellent for channel and device authentication. They become expensive when teams also use them as long-lived request bearers across every workload path — then vault and replay families return through the cert tray.
Why it fails against one-shot proofs
Coexistence keeps PKI for what it does well and moves request authorization to bound, burned envelopes. Revocation of request authority becomes a registry handle flip rather than a certificate campaign. Deep-link ambient, revocation, and replay for dual plates.
Migration language: keep mTLS where you need it; stop treating the cert as the ambient API key.
Bearer lives outside the request
How to read: long-lived bearers left; possess-once call-many ambient win. Takeaway: authority survives the call.
Ambient PKI misuse is the client cert that doubles as a forever API key.
Burned handles cannot return
How to read: revoked-handle myths fail; deactivate + ledger reject return. Takeaway: revoked or burned cannot re-authorize.
Separate jobs: certificates authenticate; envelopes authorize; revoke handles independently.
Where it shows up
Cert ≠ lasting request bearer.
Revoke request authority without a cert campaign.