Public Key Infrastructure (PKI)

A PKI implements public-key cryptography at scale. It typically includes a root certificate authority (CA), one or more intermediate CAs, registration authorities, certificate repositories, hardware security modules for key protection, and revocation infrastructure (CRL and OCSP). Subscribers generate keys, prove identity through a certificate signing request, and receive X.509 certificates that relying parties can validate by walking up the chain to a trusted root. PKI underpins TLS/HTTPS, S/MIME email, code signing, document signing, mTLS for services, smart cards and many other use cases. Strong PKI requires careful key-ceremony procedures, lifecycle automation, monitoring of Certificate Transparency logs, and clear policies (CP/CPS).