# What Is PKI (Public Key Infrastructure)? Definition and Examples

> PKI (Public Key Infrastructure) is the set of roles, policies, software and procedures used to issue, distribute, validate and revoke digital certificates.

Source: https://ssl.sh/glossary/pki/
Last updated: 2026-11-10

PKI is everything that makes it possible to trust that a public key belongs to a particular name. Its core pieces are [certificate authorities](https://ssl.sh/glossary/certificate-authority/) that sign certificates, registration processes that validate applicants, [X.509](https://ssl.sh/glossary/x509/) certificates as the data format, repositories and revocation services (CRLs and OCSP), trust stores on relying parties, and written policies (CP and CPS) that state how all of this is operated. The "Web PKI" is the public system behind HTTPS; organizations also run [private PKIs](https://ssl.sh/glossary/private-ca/) for internal use.

## Why it matters
Encryption alone does not stop an attacker who can substitute their own public key; PKI supplies the binding between keys and identities that defeats man-in-the-middle attacks. Most TLS problems are really PKI problems: an untrusted root, a missing intermediate, an expired certificate, a name mismatch or a revoked key. Understanding the hierarchy helps you decide whether a fix belongs on the server, in the client's trust store, or with the CA.

## Example
```text
Root CA (offline, in trust stores)
 └─ Intermediate CA (online, issues certificates)
     └─ example.com leaf certificate (on the web server, with its private key)
```

## Common misconceptions
- **PKI means encryption.** PKI is about authenticating keys; the bulk encryption in TLS uses symmetric session keys.
- **PKI is only for websites.** The same model secures email (S/MIME), code signing, VPNs, device identity and mutual TLS.
- **A private PKI is just a pile of self-signed certificates.** A proper private PKI has a root, issuing CAs, policies and revocation, exactly like the public one.

## Related terms

- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。
- [私有 CA](https://ssl.sh/zh/glossary/private-ca/): 私有 CA 是企业为自己的系统和设备搭建的证书颁发机构，其根证书只在企业主动安装的设备上受信任。
- [证书策略](https://ssl.sh/zh/glossary/certificate-policy/): 证书策略（CP）是针对某类证书签发和使用制定的一套命名规则，在证书的证书策略扩展中以 OID 形式引用。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。
- [信任库](https://ssl.sh/zh/glossary/trust-store/): 信任库是操作系统、浏览器或编程语言运行时内置的一组根 CA 证书，验证证书链时以它们作为信任锚。