PKI (Public Key Infrastructure)

PKI is everything that makes it possible to trust that a public key belongs to a particular name. Its core pieces are certificate authorities that sign certificates, registration processes that validate applicants, X.509 certificates as the data format, repositories and revocation services (CRLs and OCSP), trust stores on relying parties, and written policies (CP and CPS) that state how all of this is operated. The "Web PKI" is the public system behind HTTPS; organizations also run private PKIs for internal use.

Why it matters

Encryption alone does not stop an attacker who can substitute their own public key; PKI supplies the binding between keys and identities that defeats man-in-the-middle attacks. Most TLS problems are really PKI problems: an untrusted root, a missing intermediate, an expired certificate, a name mismatch or a revoked key. Understanding the hierarchy helps you decide whether a fix belongs on the server, in the client's trust store, or with the CA.

Example

Root CA (offline, in trust stores)
 └─ Intermediate CA (online, issues certificates)
     └─ example.com leaf certificate (on the web server, with its private key)

Common misconceptions

• PKI means encryption. PKI is about authenticating keys; the bulk encryption in TLS uses symmetric session keys.
• PKI is only for websites. The same model secures email (S/MIME), code signing, VPNs, device identity and mutual TLS.
• A private PKI is just a pile of self-signed certificates. A proper private PKI has a root, issuing CAs, policies and revocation, exactly like the public one.