Skip to content
uencoder

PKI

PKI (Public Key Infrastructure) is the system managing digital certificates and public keys, comprising CAs, registration authorities, certificate repositories, and revocation mechanisms, underpinning TLS and signatures.

Purpose

To provide trust management and certificate lifecycle infrastructure for public-key cryptography at scale.

Mechanism

Components: CA (issuance), RA (registration verification), certificate repository (publication), CRL/OCSP (revocation checking), CPS (policy). Chain of trust: root CA → intermediate CA → end-entity certificate. Certificate lifecycle: request → verification → issuance → use → revocation/expiry.

Use cases

  • Web TLS trust system
  • Enterprise certificate management
  • Code-signing infrastructure
  • Government e-signatures

Examples

  • Input 
    Root CA → intermediate CA → end-entity certificate
    Output 
    Chain-of-trust validation

    Up to a trusted root

Common errors

Stale CRLs let revoked certificates stay in use
Use online OCSP checks or OCSP stapling

Related terms

CA
A CA (Certificate Authority) is a trusted third party that issues digital certificates binding public keys to identities, serving as the trust root of PKI.
GLOSSARY
X.509 Certificate
An X.509 certificate binds a public key to an identity, signed by a CA for verification, containing validity, issuer, subject, and extension fields.
GLOSSARY
TLS
TLS (Transport Layer Security) provides encryption, integrity, and authentication at the transport layer; it replaced SSL and underpins HTTPS, SMTPS, and more.
GLOSSARY
Zero Trust
Zero trust is the "never trust, always verify" security model: no trust merely for being inside the network; every access verifies identity and authorization.
GLOSSARY

References