🔑Public Key Infrastructure

NEW

Also known as: PKI

A framework of roles, policies, and processes that issues, manages, and validates digital certificates and public-key cryptography.

DESCRIPTION

Public Key Infrastructure (PKI) provides the trust fabric for binding public keys to identities via certificates. It encompasses certificate authorities, registration authorities, repositories, revocation services, and policies. PKI supports authentication, integrity, and sometimes non-repudiation across distributed systems. Internet PKI underpins TLS, while enterprise PKI secures internal services and devices. Proper governance includes certificate policies, practice statements, audits, and secure key ceremonies. Resilience depends on robust revocation, lifecycle automation, and cryptographic agility.

ALTERNATIVE DEFINITIONS

Wikipedia

A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption.

Comprehensive enumeration of PKI components and functions.

Source

Cloudflare

Public key infrastructure (PKI) is the system that enables secure, encrypted communication and identity verification on the Internet using digital certificates and public-private key pairs.

Emphasizes PKI’s role in Internet security and identity verification.

Source

RELATED TERMS

Certificate Certificate Authority Registration Authority X.509 Certificate Revocation List Online Certificate Status Protocol TLS Hardware Security Module Key Management Certificate Policy

COMPETING TERMS

PGP Web of Trust

KNOWLEDGE AREAS

Data Security Infrastructure Software Engineering

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Cloud Architect IT Manager Application Administrator Software Developer IT Auditor

EXTERNAL SOURCES

• Wikipedia - Public key infrastructure
• NIST SP 800-32 - Introduction to public key technology and PKI
• IETF RFC 5280 - Internet PKI certificate and CRL profile

TOP QUESTIONS

What are the core components of a Public Key Infrastructure?

Key components include CAs, RAs, repositories, revocation services (CRL/OCSP), policies, and relying parties. Together they manage certificate issuance and validation.

Category: Explanation

How does PKI differ between public Web PKI and private enterprise PKI?

Web PKI is anchored by public roots trusted by browsers, while enterprise PKI uses private roots distributed via internal trust stores.

Category: Comparison

What is certificate path validation in PKI?

It verifies certificate chains, constraints, revocation, and usage before trust is granted. RFC 5280 defines the process for Internet PKI.

Category: Process

What risks does poor PKI governance introduce?

Mis-issuance, outages from expirations, and weak revocation checks erode trust. Governance and automation mitigate these issues.

Category: Risk

How do Hardware Security Modules support PKI?

HSMs securely generate and store CA private keys, enforcing access controls and tamper resistance for critical cryptographic operations.

Category: Infrastructure

Can PKI support post-quantum algorithms?

Yes, with standardized OIDs, profiles, and client support. Migration plans should consider hybrid certificates and algorithm agility.

Category: Future

What documents define an organization’s PKI behaviors?

Certificate Policies (CP) and Certification Practice Statements (CPS) define assurance levels, validation, issuance, and operational procedures.

Category: Governance

How does automation improve PKI operations?

ACME and certificate lifecycle tooling reduce human error, accelerate issuance, and prevent outages due to expirations.

Category: Automation

Why is revocation often unreliable in PKI?

Network constraints, soft-fail behavior, and CDNs complicate revocation checks. Short-lived certs and stapling improve reliability.

Category: Challenge