Public Key Infrastructure (PKI)

The Certificate Authority (CA) is the trusted root of the PKI hierarchy. It is responsible for issuing, signing, and managing the lifecycle of digital certificates. The CA's own public key is distributed as a root certificate and is pre-installed in operating systems and browsers, establishing a universal anchor of trust.

• Functions: Issues certificates, validates applicant identities, publishes Certificate Revocation Lists (CRLs), and maintains a secure audit trail.
• Trust Model: Acts as the ultimate trust anchor; if a CA is compromised, the entire PKI trust chain is broken.
• Example: Commercial CAs like DigiCert or Sectigo, or private enterprise CAs managed with software like Microsoft Active Directory Certificate Services.

The Registration Authority (RA) acts as the verifier and front-end for the CA. It authenticates the identity of entities requesting certificates (like users, servers, or devices) before the CA issues the certificate. The RA offloads the identity proofing workload from the CA.

• Functions: Receives certificate signing requests (CSRs), validates the requester's identity against policy, and forwards approved requests to the CA.
• Separation of Duties: This division enhances security; the CA, which holds the critical private key, can remain offline or highly isolated, while the RA handles online interactions.

A digital certificate is a standardized (X.509) electronic document that binds a public key to an identity. It is the primary credential issued by a PKI.

• Contents: Contains the subject's identity (e.g., CN=server.example.com), public key, issuer (CA) name, validity dates, serial number, and the CA's digital signature.
• Purpose: Allows a relying party to verify that a public key genuinely belongs to the claimed entity. The signature can be validated by chaining back to a trusted root CA.
• Types: Includes TLS/SSL certificates for websites, client authentication certificates, code signing certificates, and email (S/MIME) certificates.

The certificate repository is a publicly accessible directory (often using LDAP or HTTP) where issued certificates and Certificate Revocation Lists (CRLs) are published. Validation is the process a client performs to check a certificate's trustworthiness.

• Repository: Provides a way for relying parties to retrieve certificates and check revocation status.
• Validation Steps: A client (like a web browser) must:
  1. Verify the certificate's digital signature chain leads to a trusted root.
  2. Check the certificate is within its validity period.
  3. Confirm the certificate's intended use matches the current context (e.g., server authentication).
  4. Query the revocation status via a CRL or Online Certificate Status Protocol (OCSP) responder.

The Key Management System encompasses the secure generation, storage, distribution, rotation, archival, and destruction of cryptographic key pairs. This is the most critical operational aspect of a PKI.

• Private Key Security: Private keys must be stored in a Hardware Security Module (HSM), a Trusted Platform Module (TPM), or a secure software keystore to prevent theft.
• Lifecycle Management: Defines policies for key strength (e.g., RSA 2048-bit), renewal schedules, and secure archival of old keys for decrypting historically encrypted data.
• Compromise Response: Defines procedures for immediate key revocation and re-issuance if a private key is suspected to be lost or stolen.

The Certificate Policy (CP) and Certificate Practice Statement (CPS) are the governing documents that define how the PKI is operated and managed.

• Certificate Policy (CP): A high-level document that outlines the trust model, security requirements, and intended uses of certificates issued under the PKI. It answers 'what' and 'why'.
• Certificate Practice Statement (CPS): A detailed, operational manual that explains 'how' the CA implements the CP. It specifies technical standards, procedures for identification, issuance, revocation, auditing, and liability.
• Importance: These documents are essential for auditability, interoperability between different PKIs, and establishing legal and operational accountability.