Cybersecurity glossary
What is Public Key Infrastructure (PKI)?
Learn what Public Key Infrastructure (PKI) is, how certificate authorities keys and policies establish trust, how public and private PKI differ, and which operational practices keep PKI secure.
Definition
Public Key Infrastructure (PKI) is the combination of policies, processes, technology, and Certificate Authorities that creates, distributes, manages, stores, and revokes digital certificates and public-key credentials used for authentication and encryption.
Why PKI matters
Public-key cryptography alone is not enough. You also need a trustworthy way to answer: “Whose key is this?” Public Key Infrastructure (PKI) provides that answer through certificates, Certificate Authorities, policies, and lifecycle operations.
Without PKI, every pair of systems would need an out-of-band key exchange. With PKI, browsers trust a limited set of roots, enterprises issue internal identities, and services authenticate with automated certificates—when operations keep up.
Core PKI building blocks
Certificate Authorities
Trusted issuers that sign certificates binding keys to identities under policy.
Certificates and keys
X.509 certificates carry public keys; private keys must remain protected.
Registration & validation
Processes that prove domain control, device ownership, or organizational identity.
Revocation & status
CRL/OCSP or short-lived certs communicate when trust should end early.
How trust is established
Establish trust anchors
Relying parties load root CA certificates in browsers, OSes, or private trust stores.
Issue credentials
A CA validates a request and signs a certificate for a subject and public key.
Distribute certificates
Servers, devices, or users install certificates and protect matching private keys.
Authenticate in protocols
TLS, S/MIME, code signing, or mTLS prove possession of the private key.
Validate chains
Clients verify signatures, names, validity periods, usage, and status.
Renew or revoke
Lifecycle events keep identity bindings current as systems and risks change.
Public vs private PKI
| Property | Public PKI | Private PKI |
|---|---|---|
| Trust distribution | Default browser/OS trust stores | Explicitly installed enterprise roots |
| Typical use | Internet HTTPS and public code signing | mTLS, VPN, device/user certificates |
| Governance | CA/Browser Forum and root programs | Internal policy and auditors |
Operational checklist
- Inventory every certificate and owning service—public and private.
- Protect CA and intermediate keys in HSMs with multi-person control.
- Automate issuance/renewal; alert on expiry before outages.
- Separate issuing CAs by purpose (users, devices, servers) when blast radius matters.
- Monitor Certificate Transparency for unexpected public certificates.
- Test revocation and emergency re-issue procedures.
- Keep private roots out of places that do not need them.
- Treat registrar/DNS control as part of public PKI security.
The practical takeaway
PKI is the trust system behind digital certificates: CAs, policies, keys, validation, and revocation. It makes scalable authentication possible for the web and for enterprise machine identity.
Secure PKI is equal parts cryptography and operations. Protect issuers, automate lifecycle, and validate certificates correctly—or the strongest algorithms still fail at the trust layer.
Related security terms
Certificate Authority (CA)
The trusted issuer at the heart of most PKI designs.
X.509 Certificate
The standard certificate format used throughout PKI.
Certificate Revocation (CRL/OCSP)
How PKI communicates that issued credentials are no longer trusted.
Certificate Authentication
Using PKI credentials to prove identity for users, devices, and services.
Frequently asked questions
What is PKI in simple terms?
PKI is the system that issues and manages digital certificates so computers can trust public keys. It is how browsers trust HTTPS sites and how enterprises issue laptop or VPN certificates.
What problems does PKI solve?
It binds identities to public keys, enables encrypted and authenticated communications, and provides lifecycle controls such as renewal and revocation.
What is the difference between public and private PKI?
Public PKI uses CAs trusted by browsers and OSes for internet TLS. Private PKI is operated for internal identities and is trusted only where you install its roots.
What are the main PKI components?
Certificate Authorities, registration/validation processes, certificates and keys, repositories, revocation services, and relying-party trust stores/policies.
Why do PKI outages matter?
Expired certificates and broken issuance can take down websites, APIs, VPNs, and machine authentication simultaneously.
Is PKI only for websites?
No. PKI also supports email signing/encryption, code signing, document signing, device identity, VPN, and service mesh mTLS.
What is the biggest PKI operational risk?
Compromise or mismanagement of CA private keys, followed closely by inventory failures that let certificates expire unnoticed.
References
Explore authoritative guidance and frameworks related to public key infrastructure (pki).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.