Public key infrastructure is the system of certificates and authorities that lets others trust a cryptographic identity.
A certificate binds a name to a public key, and a chain of issuers shows why a relying party should accept it.
How it works
Browsers, mail servers, and device management tools keep a set of trusted issuers.
When a server presents a certificate, the client checks the chain, the name, the dates, and whether the certificate was revoked.
If an issuer is careless, or a private key leaks, trust in every certificate under that issuer is damaged.
Running the infrastructure well means protecting keys, limiting what each certificate may do, and retiring them on time.
Concrete examples
- A website certificate lets a browser confirm it is talking to the named shop before sending a password.
- A company issues device certificates so only managed laptops can open an internal application.
- A mail signature certificate lets recipients check that a message still matches the sender key.
Protective measures
- Protect private keys in a controlled store and limit how many people can ask for a new certificate.
- Set short lifetimes for high value certificates and automate renewal so expiry does not surprise operators.
- Monitor revocation and issuer changes, and remove trust in an issuer that no longer meets your standard.
- Match certificate names to the real service names so a valid chain cannot excuse the wrong host.