Public Key Infrastructure

Public Key Infrastructure (PKI) is the system of policies, roles, hardware, and software that creates, manages, and validates digital certificates.

Its core job is to bind a public key to a verified identity (a website, a person, or a server) so others can trust it.

Public-key cryptography lets anyone publish a public key. But how do you know a key really belongs to bank.com and not an attacker?

PKI solves this by having a trusted third party vouch for the key by signing a certificate.

A digital certificate ties a public key to an identity. It contains:

• The subject's name (e.g. a domain)
• The subject's public key
• The issuer (the authority that signed it)
• Validity dates
• The issuer's digital signature

Most certificates follow the X.509 standard. You can inspect one with OpenSSL.

Every certificate is built on an asymmetric key pair:

• The private key stays secret on the server.
• The public key is shared inside the certificate.

Data signed by the private key can be verified with the public key, and vice versa.

An authority hashes the certificate data and encrypts that hash with its own private key. This is the signature.

Anyone with the authority's public key can verify the signature, proving the certificate has not been tampered with.

PKI involves several roles:

• Certificate Authority (CA) issues and signs certificates.
• Registration Authority (RA) verifies identities before issuance.
• Certificate Repository stores and distributes certificates.
• Relying Party is anyone who trusts and uses a certificate.

Trust starts at a root certificate that is self-signed and pre-installed in operating systems and browsers.

This root is the trust anchor. If you trust the root, you can trust everything it correctly signs.

To get a certificate, you generate a Certificate Signing Request (CSR) containing your public key and identity, then send it to a CA.

PKI is everywhere:

• HTTPS / TLS for secure web traffic
• Code signing to prove software authenticity
• Email security via S/MIME
• VPNs and device authentication

Certificates have a full lifecycle: request, issue, deploy, renew, and revoke.

Good PKI hygiene means tracking expiry dates and revoking compromised keys quickly. A neglected certificate is a security risk.

What is the primary purpose of PKI?

You learned that PKI binds public keys to identities using digital certificates.

• Trust flows from pre-installed root certificates.
• CAs sign certificates; relying parties verify signatures.
• Certificates follow the X.509 standard and have a full lifecycle.

Next, we look at the authorities that issue these certificates.