# What is Public Key Infrastructure (PKI)?

> Public key infrastructure (PKI) is the governed combination of roles, policies, processes, systems, cryptographic keys, and digital certificates used to establish and maintain trust relationships involving public keys.

- Canonical URL: https://yellowcube.eu/glossary/public-key-infrastructure/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A PKI defines how identities or attributes are validated, who may issue certificates, which uses are permitted, how relying parties validate them, and how status, compromise, expiry, and retirement are handled.

Roles include subscribers, relying parties, certificate authorities, registration authorities, repositories, and status services. Trust anchors and certification paths let a relying party evaluate an end-entity certificate under a chosen policy rather than trust every issuer.

### Key points

- **Governance and roles:** Establish certificate policies and practice statements, identity-proofing rules, authorized issuers, separation of duties, audit requirements, and relying-party obligations.
- **Issuance and key lifecycle:** Generate keys securely, approve certificate requests, issue certificates with constrained identities and uses, renew or rekey them, and protect certification-authority signing keys.
- **Validation and status:** Validate certification paths, enforce names, validity periods, key usages, constraints, algorithms, and policies, and obtain status information when the application requires it.
- **Important limitation:** PKI establishes assertions under an issuer and policy; it does not prove that a subject is trustworthy, an endpoint is uncompromised, or a transaction is safe. Weak proofing, misplaced trust anchors, stolen keys, validation errors, or unavailable status data can undermine it.

### Related terms

[Cryptography](<https://yellowcube.eu/glossary/cryptography/>) · [Digital certificate](<https://yellowcube.eu/glossary/digital-certificate/>) · [Certificate management](<https://yellowcube.eu/glossary/certificate-management/>) · [Online Certificate Status Protocol (OCSP)](<https://yellowcube.eu/glossary/online-certificate-status-protocol/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Digital signature](<https://yellowcube.eu/glossary/digital-signature/>) · [Transport Layer Security (TLS)](<https://yellowcube.eu/glossary/transport-layer-security/>)

### Sources

[RFC 5280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile](https://www.rfc-editor.org/info/rfc5280) · [RFC 3647: Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://www.rfc-editor.org/info/rfc3647) · [NIST SP 800-57 Part 1 Rev. 5: Recommendation for Key Management](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.