Also: PKI, certificate authority, digital certificates, X.509
A public key infrastructure is the system of certificates, certificate authorities and revocation mechanisms that lets a party verify which identity a public key belongs to before trusting it.
Our take. PKI is the part of security that works so well nobody notices it, and fails so loudly when a certificate expires that everybody does. Most organisations should treat certificate expiry as an operations problem to be automated away, not a security event to be handled by hand, and should run their own internal authority for anything that never faces the public internet.
Asymmetric encryption solves the problem of exchanging keys and creates another: the public key you have been handed could belong to anyone. A certificate answers that. It is a signed statement, in a standard format, that a named identity holds a particular public key, and the signature comes from a certificate authority whose own key your system already trusts. Your browser trusts a few dozen root authorities, those roots sign intermediate authorities, and the intermediates sign the certificates websites present. Verifying a website means walking that chain from the presented certificate back to a root you hold, checking each signature and each validity period on the way.
The infrastructure part is everything around that chain: issuing certificates after checking the requester controls the name, publishing revocation information so a compromised certificate can be withdrawn before it expires, and rotating the keys of the authorities themselves. Public web certificates are now short-lived and issued automatically by protocol, which has moved the failure mode from forgery, which was always rare, to expiry, which is common. Internal systems, service-to-service traffic and device identity are where organisations run their own authorities, because there is no reason to pay a public one to vouch for names nobody outside will ever resolve.
Root authority: trusted by configuration, kept offline, used rarely.
Intermediate authority: signed by the root, does the day-to-day issuing, can be revoked without replacing every trust store.
End certificate: presented by the server, device or person; short-lived by modern practice.
Revocation: lists or online status checks that let a certificate be withdrawn early; the weakest link in most deployments.
Automation: the issuing protocol used by public authorities, and increasingly by internal ones, so that renewal is a process and not a calendar reminder.
In practice
An internal reporting service is reached over an encrypted connection using a certificate a developer created by hand, signed by nobody, and installed with a click on every laptop that needed it. It works, and it teaches every user to click through certificate warnings, which is the habit an attacker most wants them to have. The alternative is an internal authority: one root the company controls, distributed to managed devices once, an intermediate that issues short-lived certificates to internal services automatically, and no warnings anywhere. When the reporting service's certificate expires it is renewed by the same automation that renewed it last month, and the developer never learns the date.
TLS is the protocol that protects a connection; PKI is how the parties know whose key they are talking to. TLS uses certificates from a PKI, and a PKI issues certificates for uses well beyond TLS.
Owning a domain name lets you prove control of it to a certificate authority, which is how a public certificate is issued. The name is the identity; the certificate is the attestation.
Key takeaways
→A certificate is a signed statement that a name holds a key; trust flows down a chain from a root you already hold.
→Expiry, not forgery, is the practical failure mode; automate renewal.
→Run an internal authority for anything the public internet never sees.
Certifications that test this
Vendor exams whose syllabus covers this concept — facts, cost and a preparation path on each page.
A rotating selection from the course directory, drawn from the subcategories where this concept is taught rather than picked for it. Details, price and the provider link are on the course page.
(updated September 2025)We have made various minor improvements to the course content. These include updating captions…
Udemy
FAQ
Why do certificates expire at all?
Because revocation is unreliable and keys leak. A short lifetime bounds the damage a stolen certificate can do and forces the renewal automation that keeps the whole system healthy. Public web certificates have become steadily shorter for exactly that reason.
What is the difference between a root and an intermediate authority?
The root is trusted by configuration and kept offline because replacing it means touching every trust store. The intermediate is signed by the root and does the daily issuing; if it is compromised it can be revoked and replaced without disturbing the root.
Should a company run its own certificate authority?
For internal services, device identity and anything that never faces the public internet, yes, and modern tooling makes it routine. For public websites, no; browsers trust only the public roots, and automated issuance from a public authority is free.
Sources
The primary text this definition rests on. Read it before you trust ours.
