What Is PKI?
Author: Domeny.ForSale editorial team Published
In brief: PKI is public key infrastructure: a system of certificates, institutions, procedures and tools that links a cryptographic key to a domain, person or device. This allows a browser to check whether it is connecting to the correct server, and a corporate network to recognise an authorised computer. PKI underpins many uses of HTTPS, authentication and digital signatures, but does not itself guarantee the honesty of a website owner or the security of an entire system.
How PKI links a key to an identity
PKI stands for Public Key Infrastructure. It is based on asymmetric cryptography, which uses a pair of mathematically related keys: a public key and a private key. The public key can be shared, while the private key must remain under its owner’s control.
For a digital signature, the private key is used to create the signature, and the public key to verify it. Successful verification confirms that the signature was created using the corresponding private key and that the signed data has not been altered. However, the key pair alone does not tell us who owns it.
This problem is addressed by a digital certificate: an electronic credential that binds a public key to a particular entity or identifier, such as a domain name. It contains, among other things, the public key, information about the subject, the issuer, the validity period and permitted uses. In the widely used X.509 format, the certificate is digitally signed by its issuer.
What the certificate attests to depends on its type. A basic HTTPS server certificate confirms control over the specified domain according to the issuer’s procedure, not the trustworthiness of a shop or the quality of its offering.
What makes up PKI
PKI is not a single certificate, but an entire system for issuing and managing credentials. Its main components are:
- Certificate authority (CA) — issues and signs certificates, confirming a specified link between a key and an entity.
- Registration authority (RA) — checks applications and eligibility to receive a certificate. The CA itself may perform this function.
- Trust store — a collection of trusted certificates maintained, for example, by an operating system, browser or company administrator.
- Revocation checking mechanisms — make it possible to determine whether a certificate has been revoked before its expiry date. These include certificate revocation lists (CRLs) and the OCSP protocol.
- Management policies and tools — define who receives a certificate, how keys are protected, and how renewal or revocation is handled.
Trust usually forms a chain: the server certificate was signed by an intermediate CA, and that CA’s certificate leads to a trusted root certificate authority, or root CA. The root certificate is usually self-signed, but that signature is not what makes it trustworthy. Its prior inclusion in the trust store is what matters.
What happens during an HTTPS connection
HTTPS is HTTP protected by TLS, a protocol that secures communication between a browser and a server. PKI helps confirm the server’s identity during this process.
Suppose you open sklep.example. In simplified terms, the browser performs the following steps:
- Receives the server certificate and the intermediate certificates needed to build a chain of trust.
- Checks whether the certificate covers the name
sklep.example, is within its validity period and can be used for server authentication. - Verifies the signatures in the chain and checks whether it leads to a trusted authority. How revocation information is handled depends on the software and its policies.
- As part of the TLS handshake, verifies proof that the server possesses the appropriate private key and agrees on session keys.
The certificate does not encrypt all traffic on its own. In modern TLS, data is protected by efficient symmetric cryptography using the agreed session keys. The certificate and private key primarily play a role in authenticating the server.
Properly implemented HTTPS protects data in transit, but does not confirm the recipient’s good intentions. A fraudulent shop can also have a valid certificate for its domain.
Public or private PKI — which should you choose?
Public PKI relies on authorities that are widely trusted by browsers and operating systems. It is the right choice for a publicly accessible website: visitors should not have to manually install your authority’s certificate. When choosing a service, check its current compatibility with the clients in use, its validation rules and its automatic renewal capabilities.
Private PKI operates within an organisation or a controlled environment. The company sets its own certificate issuance policies and configures managed devices to trust its CA. These certificates do not automatically become trusted on the computers of customers outside the company.
For example, a public company website needs a certificate recognised by users’ browsers. By contrast, private PKI can be used to authenticate company laptops on a Wi-Fi network: each laptop receives its own certificate, which can be revoked if the device is lost. Private PKI is also sometimes used in VPNs and mTLS, meaning TLS with certificate-based authentication of both parties to the connection.
What needs to be maintained after a certificate is issued
The most important responsibilities begin once the system is up and running. Private keys need protection against copying and unauthorised use, while certificates require an inventory, expiry monitoring and reliable renewal. An expired certificate can interrupt the operation of a website, an API or network access.
If a private key is exposed, simply downloading the certificate again is not enough. You need to generate a new key pair, obtain a new certificate, revoke the previous one and address the cause of the leak. The effectiveness of revocation also depends on whether the systems using the certificate check its status.
Before deployment, establish who needs to trust the certificates: any internet user or only managed devices. Then assign responsibility for protecting keys, automatic renewal and responding to key compromise — without these arrangements, even a correctly configured PKI will be difficult to maintain securely.
See also: What Is MCP?
Read also
