Public key infrastructure (PKI) is the system of policies and services to issue and manage digital certificates that bind public keys to identified subjects.

Public-key cryptography supplies the underlying mathematical operations. PKI addresses the operational question of which keys to trust and for what purpose. It includes the organizations responsible for issuance and the processes used when a certificate expires or a private key is compromised.

How PKI establishes trust

A certificate authority (CA) signs certificates under a defined policy. Before issuance, the applicant’s identity or control of a resource is checked according to the certificate type. A registration authority can perform some of those checks on the CA’s behalf.

The resulting certificate contains a public key and information about its subject, together with validity and usage constraints. A relying application checks the certificate against trust anchors it already accepts. Intermediate certificates can connect the presented certificate to an accepted root through a certification path.

The application must evaluate the whole path and relevant constraints, not merely confirm that some CA signature is present. Trust also depends on the intended use: a certificate acceptable for one purpose may not be acceptable for another.

The certificate lifecycle

Enrollment establishes which subject receives a certificate and how its key is generated and protected. After issuance, the certificate must be installed where it is needed, with a known owner and renewal process.

Revocation communicates that a certificate should no longer be accepted before its scheduled expiration. Certificate revocation lists and online status protocols are mechanisms for publishing that information. How clients obtain and act on status information depends on the ecosystem and its validation policy.

Renewal avoids avoidable service failures from expired certificates. Replacing a compromised key requires more than extending the old certificate’s lifetime: systems need a new trustworthy key association and a plan to stop accepting the affected credential.

PKI in customer-facing services

An online portal uses a server certificate so browsers can authenticate the endpoint while establishing a protected connection. A separate private PKI might issue certificates to services exchanging customer data internally. Both use certificates, but their trust stores and issuance policies can differ.

An enterprise may trust a private CA that public browsers do not recognize. That is appropriate for a controlled internal environment only when clients are configured to trust the correct authority. Installing a new trust anchor changes what those clients may accept and should be tightly governed.

PKI does not decide which customer records a service may read. The authenticated identity must still be mapped to application permissions.

Frequently asked questions

Is PKI the same as a digital certificate?

No. A certificate is one object used within PKI. The infrastructure also includes issuance policy, trusted authorities and lifecycle operations.

Do all PKI certificates work in public browsers?

No. Acceptance depends on the browser’s trust store and validation rules. Certificates from a private CA normally need an explicitly configured trust relationship.

Why revoke a certificate before it expires?

A key may be compromised or the certified relationship may no longer be valid. Revocation provides a way to withdraw trust before the validity period ends.

Related: Machine Identity · Non-Human Identity · Credential Management · Identity Lifecycle · API Security · Zero Trust