What Is Public Key Infrastructure (PKI)?
Public Key Infrastructure (PKI) is the system of keys, certificates, and authorities that binds a public key to a real-world identity. Asymmetric cryptography lets anyone publish a public key — but on its own, a key proves nothing about who owns it. PKI is what turns “here is a key” into “this key provably belongs to example.com.”
What problem is PKI actually solving?#
Imagine encrypting a message to your bank’s public key. How do you know the key you grabbed is really the bank’s, and not an attacker’s key swapped in during a man-in-the-middle attack? Raw public keys have no built-in identity. PKI answers this by having a trusted third party — a certificate authority (CA) — issue a signed certificate that vouches: this public key belongs to this identity.
How does the chain of trust work?#
Trust is delegated in a chain that ends at a root you already trust:
| Layer | Role |
|---|---|
| Root CA | Ultra-protected; its certificate ships pre-trusted in OSes and browsers |
| Intermediate CA | Signed by the root; issues end certificates day-to-day |
| End-entity certificate | Your site’s cert, signed by an intermediate |
To verify, software walks up from the site certificate through the intermediates until it reaches a pre-installed root. If the chain is complete and every signature valid, trust is established; if not, you get a certificate warning.
PKI is what makes digital signatures and TLS trustworthy in practice. The authorities themselves are covered in certificate authorities. More at the Security Fundamentals hub.
Frequently asked questions#
What problem does PKI solve?
Asymmetric cryptography lets anyone publish a public key, but nothing about a raw key proves whose it is. PKI solves that binding problem: a trusted certificate authority vouches, in a signed certificate, that a specific public key belongs to a specific identity. Without PKI, you could encrypt to a key with no idea who holds it.
What is a certificate chain?
A chain of trust from a certificate up to a root you already trust. Your certificate is signed by an intermediate authority, which is signed by a root authority whose key ships in your operating system or browser. Verification walks the chain up until it reaches a pre-trusted root, or fails if it cannot.