Public Key Infrastructure (PKI)

The trust anchor responsible for issuing, revoking, and managing digital certificates. The CA verifies the identity of entities requesting certificates and digitally signs them, creating a chain of trust. In enterprise audit logging, a private CA ensures that only authorized systems can sign log entries, preventing impersonation.

• Root CA: The ultimate trust anchor, typically kept offline for security
• Issuing CA: Subordinate authorities that handle day-to-day certificate issuance
• Validation levels: Domain Validation (DV), Organization Validation (OV), Extended Validation (EV)

An optional component that acts as a vetting intermediary between end entities and the Certificate Authority. The RA authenticates user identities, validates requests, and forwards approved certificate signing requests to the CA. This separation of duties enhances security by limiting direct access to the CA.

• Verifies identity documents and organizational affiliation
• Enforces enrollment policies before CA involvement
• Common in large-scale enterprise and government PKI deployments

An electronic document conforming to the X.509 standard that binds a public key to a specific identity. Certificates contain the subject's distinguished name, public key, validity period, and the issuing CA's digital signature. For audit logging, certificates enable non-repudiation by cryptographically proving which entity signed a specific log entry.

• Subject fields: Common Name (CN), Organization (O), Country (C)
• Extensions: Key Usage, Extended Key Usage, Subject Alternative Name (SAN)
• Serial number: Unique identifier used in Certificate Revocation Lists

A time-stamped, CA-signed list of revoked certificates that have been invalidated before their expiration date. Relying parties must check the CRL to ensure a certificate is still valid before trusting it. Revocation is critical when a private key is compromised, an employee leaves, or a system is decommissioned.

• Full CRL: Complete list of all revoked certificates from a CA
• Delta CRL: Incremental updates containing only recent revocations
• Revocation reasons: Key compromise, affiliation change, cessation of operation

A real-time alternative to CRLs that allows clients to query the validation status of a single certificate without downloading an entire revocation list. An OCSP responder, operated by the CA, returns a signed response indicating whether the certificate is good, revoked, or unknown.

• OCSP Stapling: The server includes a cached OCSP response in the TLS handshake, reducing latency and privacy concerns
• Must-Staple: A certificate extension requiring OCSP stapling, forcing real-time validation
• Critical for high-frequency audit log signing where immediate revocation checking is required

A dedicated, tamper-resistant hardware appliance that generates, stores, and manages private keys in a secure enclave. HSMs ensure that CA signing keys and audit log signing keys never exist in plaintext outside the device, meeting FIPS 140-2 Level 3 compliance requirements.

• Performs all cryptographic operations within the secure boundary
• Tamper-evident seals and automatic key zeroization on physical intrusion
• Used to protect root CA keys and high-value audit signing keys