PKI - Public Key Infrastructure Explained

About 2 min read

PKI (Public Key Infrastructure) is a general term for the framework used to issue, manage, and verify digital certificates. A certificate authority (CA) verifies the owner of a public key and issues a certificate, serving as the foundation of trust for TLS communication and digital signatures. As of 2025, the move to shorten certificate validity periods (to 90 days) is accelerating, making automation even more important.

Real-World Use Cases

"We built an in-house PKI and issued client certificates to all employees. By requiring certificate-based authentication in addition to passwords for VPN connections, we have established a system that prevents unauthorized access even if credentials are leaked through phishing."

PKI Architecture Diagram

Components of PKI

PKI consists of a root CA (the top-level certificate authority), intermediate CAs (certificate authorities delegated by the root CA), end-entity certificates (certificates issued to servers and users), and CRL/OCSP (means of checking revoked certificates). A browser can trust an HTTPS site because it can follow the chain of trust from the server certificate up through the intermediate CA to the root CA, reaching a root CA pre-registered in the browser.introductory books on PKI (Amazon) offer a systematic way to learn.

Practical Use Scenarios

In enterprise PKI, an internal CA is built to issue employee certificates, which are used for VPN connections and email encryption. In IoT environments, device certificates are used to ensure that only legitimate devices can connect to the network. In cloud environments, AWS Certificate Manager and Let's Encrypt automate certificate issuance and renewal, greatly reducing the operational burden. Learning about PKI after understanding the basics of encryption makes the overall picture easier to grasp.

Operational Considerations

The greatest risk in PKI is the leakage of a CA's private key. If the private key of a root CA is leaked, trust in all certificates issued by that CA collapses. The ironclad rule is to protect the CA's private key with an HSM and to operate the root CA offline. Protect the CA management console with a strong random password and automate the management of certificate expiration dates.books on certificate management (Amazon) are also helpful references.