A PKI defines how identities or attributes are validated, who may issue certificates, which uses are permitted, how relying parties validate them, and how status, compromise, expiry, and retirement are handled.
Roles include subscribers, relying parties, certificate authorities, registration authorities, repositories, and status services. Trust anchors and certification paths let a relying party evaluate an end-entity certificate under a chosen policy rather than trust every issuer.
Key points
Governance and rolesEstablish certificate policies and practice statements, identity-proofing rules, authorized issuers, separation of duties, audit requirements, and relying-party obligations.
Issuance and key lifecycleGenerate keys securely, approve certificate requests, issue certificates with constrained identities and uses, renew or rekey them, and protect certification-authority signing keys.
Validation and statusValidate certification paths, enforce names, validity periods, key usages, constraints, algorithms, and policies, and obtain status information when the application requires it.
Important limitationPKI establishes assertions under an issuer and policy; it does not prove that a subject is trustworthy, an endpoint is uncompromised, or a transaction is safe. Weak proofing, misplaced trust anchors, stolen keys, validation errors, or unavailable status data can undermine it.