Digital Certificates & PKI
Overview
A digital certificate connects a public key to an identity. PKI is the full set of people, policies, hardware, software, and procedures that manage public-key cryptography at scale.
Key concepts
- Certificate authority, registration authority, CSR
- Root vs. intermediate certificates, certificate chain
- CRL, OCSP, certificate expiration
How it works
A digital certificate is an electronic document that connects a public key to an identity, letting users and systems verify the identity of websites, people, devices, and organizations.
PKI (Public Key Infrastructure) is the people, policies, hardware, software, certificates, and procedures used to manage public-key cryptography — supporting secure communication, authentication, encryption, and digital signatures.
Issuing & trust chain
| Component | Role |
|---|---|
| Certificate authority | Trusted organization that issues and signs digital certificates. |
| Registration authority | Verifies an identity before a certificate is issued. |
| Certificate signing request | A request sent to a CA to obtain a digital certificate. |
| Root certificate | The trusted certificate at the top of a certificate hierarchy. |
| Intermediate certificate | Issued by a root CA and used to issue other certificates. |
| Certificate chain | The sequence of certificates linking a certificate back to a trusted root. |
Validity & revocation
| Component | Role |
|---|---|
| Certificate revocation list (CRL) | A list of certificates canceled before their expiration date. |
| Online Certificate Status Protocol (OCSP) | A method for checking whether a certificate is currently valid or revoked. |
| Certificate expiration | The date after which a certificate is no longer valid. |
| TLS certificate | A certificate used to authenticate a website/online service and secure its communications. |