PKI Basics: How Public Key Infrastructure Works

What Is PKI?

Public Key Infrastructure is the ecosystem that makes asymmetric cryptography practical at internet scale. At its core, PKI solves a fundamental problem: how does one party verify that a public key truly belongs to who they claim to be? The answer is digital certificates — cryptographically signed documents that bind a public key to an identity.

A certificate is issued by a Certificate Authority (CA). The CA signs the certificate with its own private key. Anyone who trusts the CA can verify that signature and thereby trust the certificate. This creates a chain of trust: your browser trusts a set of root CAs (baked into the OS or browser), those roots sign intermediate CAs, and the intermediates sign the end-entity certificates used by websites.

The Certificate Chain

When you connect to a website over HTTPS, the server presents a certificate chain. Your browser walks the chain from the leaf certificate up through intermediates to a root CA it already trusts. If every signature in that chain is valid and no certificate has been revoked, the connection is authenticated.

Key Components of PKI

• Root CA
  Self-signed, offline, the ultimate trust anchor. Operators go to extraordinary lengths to protect root private keys — air-gapped machines, multi-party ceremonies, HSMs in locked cages.
• Intermediate
  Signed by the root, used for day-to-day issuance. If compromised, it can be revoked without touching the root, limiting the blast radius.
• Leaf Cert
  The certificate presented by a server or user. Short-lived (often 90 days) to limit exposure from compromise. Automated renewal via ACME/Let's Encrypt.
• CRL/OCSP
  Revocation mechanisms. Check whether a certificate has been revoked before its expiration. OCSP stapling lets servers pre-fetch and cache the response.

PKI and Passkeys

Passkeys extend PKI concepts to the authentication layer. Each passkey is a key pair: the private key lives in a secure enclave on the user's device, the public key is registered with the service. When authenticating, the device signs a challenge with the private key; the service verifies with the stored public key. Attestation — proving the key was generated by a legitimate authenticator — uses another PKI chain rooted at the device manufacturer.