Public key infrastructure (PKI)

Public key infrastructure (PKI) is the system of keys, certificates and trusted issuers that lets machines prove who they are to each other, with no person present. It is what makes your browser trust your bank's website, and what lets one company server trust another. A certificate is a small digital document that says this public key belongs to this name. It is signed by an issuer that others already trust, called a certificate authority (CA).

Here is how it works in general. A machine creates a pair of keys that belong together. The private key stays secret on the machine. The public key can be given to anyone. Data locked with the public key can be unlocked only with the private key. The private key can also make a digital signature, which anyone can check with the public key. Next, the machine's owner asks a certificate authority for a certificate. The CA checks that the owner really controls the name, such as a website address, and signs the certificate. Browsers and operating systems come with a list of trusted CAs already installed. When another machine connects, it receives the certificate, checks the CA's signature on it, and asks the machine to prove that it holds the matching private key. Only then does it trust the connection. Certificates expire and must be renewed. A certificate whose private key is stolen can be cancelled before it expires, which is called revocation.

Take, for example, the padlock in a browser's address bar. It appears after the browser has checked the website's certificate. The browser and the website then set up encryption for the visit.

Consider a company director who files the company's returns online in India. The filing is signed with a digital signature certificate (DSC), issued by a certifying authority that India licenses under the Information Technology Act, 2000.

Say a factory has hundreds of machines that send readings to its servers. Each machine can be given its own certificate, so that the servers accept readings only from the factory's own machines.

Certificates are being made shorter-lived. Public website certificates used to last about a year, and under rules agreed by browser makers and certificate authorities, the limit is shrinking in steps to 47 days by 2029. No person can renew thousands of certificates that often, so certificate lifecycle management finds and renews them automatically. Each certificate is also a non-human identity.

How is PKI different from encryption? Encryption scrambles data so that only the holder of the key can read it. PKI answers a different question: whose key is this? Without PKI, a browser could set up perfect encryption with an attacker who is pretending to be the bank.