Public Key Infrastructure (PKI)

PKI enables secure communications and digital signatures through certificate-based trust.

PKI components

• Certificate Authority (CA): Issues and signs certificates.
• Registration Authority (RA): Verifies certificate requests.
• Certificate Revocation List (CRL): Lists revoked certificates.
• OCSP: Online Certificate Status Protocol for real-time checking.

Certificate lifecycle

1. Generation: Create key pair (public/private).
2. Enrollment: Submit certificate signing request (CSR).
3. Issuance: CA verifies identity and issues certificate.
4. Deployment: Install certificate on servers/devices.
5. Renewal: Replace before expiration.
6. Revocation: Invalidate if compromised.

Use cases

• HTTPS/TLS for encrypted web traffic.
• Code signing for software authenticity.
• Email encryption (S/MIME, PGP).
• Document signing for legal validity.
• VPN and network authentication.

Trust hierarchy

• Root CA (self-signed, trusted by OS/browsers).
• Intermediate CAs (signed by root).
• End-entity certificates (signed by intermediate).