Public key infrastructure

A public key infrastructure (PKI) brings together the processes, roles, policies and technical components used to manage digital certificates throughout their entire lifecycle. At its heart lies asymmetric cryptography: each key pair consists of a public and a private key, and a trusted certification authority (CA) binds the public key to an identity in a legally meaningful way via a signed X.509 certificate. A PKI thereby enables authenticity, integrity, confidentiality and non-repudiation for communication, signatures and encryption.

The trust model rests on hierarchical chains of trust: a root CA acts as the trust anchor and signs subordinate intermediate certification authorities (sub-CAs), which in turn issue end-entity certificates. Key building blocks are the registration authority (RA) for identity verification, a directory service that publishes certificates, and revocation mechanisms such as the certificate revocation list (CRL) and the Online Certificate Status Protocol (OCSP). The relevant procedures are formally defined in a certificate policy (CP) and a certification practice statement (CPS).

In the context of information security, a PKI is a central tool for implementing protection objectives and access control. It underpins TLS-secured connections, qualified electronic signatures under the eIDAS Regulation, S/MIME email encryption and certificate-based authentication in zero-trust architectures. The BSI IT-Grundschutz framework and ISO/IEC 27001 require managed key handling, and a PKI operationalises this requirement. The protection of private keys is critical and is often achieved using hardware security modules (HSM), together with end-to-end lifecycle management from issuance to revocation.