Public Key Infrastructure (PKI)

Public Key Infrastructure is the system of roles, certificates, and services that makes public keys trustworthy between strangers. A certificate authority (CA) signs certificates binding an identity to a public key; a registration authority (RA) verifies the applicant’s identity before issuance; repositories publish certificates; and revocation services (CRLs and OCSP) announce which certificates should no longer be trusted. Trust flows in chains, from a root CA through intermediates down to the certificate a browser or server presents.

The nuance is that PKI is trust management, not cryptography itself: the mathematics lives in asymmetric encryption and digital signatures; PKI answers the prior question of whose key this really is. Its weak points are operational. Revocation checking often fails soft, a compromised CA poisons everything beneath it, and applications that must not inherit that exposure narrow their trust with certificate pinning.

Exam relevance: binding an identity to a public key is the trigger phrase, and the answer is a certificate issued by a CA. Role questions recur: the CA signs and vouches, the RA verifies identity but never signs. For revocation, CRLs are periodic downloads while OCSP checks status in real time. The confusable is the web of trust model (PGP), where users countersign each other’s keys with no central authority: if there is no CA, it is not PKI.