Read as
Last updated: April 29, 2026
PKI = the trust infrastructure for asymmetric crypto. Most engineers use it; few understand it.
PKI = the trust infrastructure for asymmetric crypto. Most engineers use it; few understand it.
The components
- Certificate Authority (CA) — issues certs; private key very protected
- Certificate Signing Request (CSR) — what you submit to a CA
- X.509 certificate — public key + identity, signed by CA
- Certificate chain — your cert → intermediate CA → root CA
- Revocation — CRL or OCSP; “this cert no longer valid”
The validation flow
- Server presents cert + chain
- Client verifies chain back to a trusted root
- Client checks cert validity (dates, hostname)
- Client checks revocation (OCSP / CRL / CT log)
- Trust established
Common issues
- Self-signed cert in production (no chain)
- Expired certs (monitor!)
- Wrong CN/SAN (cert doesn’t match hostname)
- Weak signature algorithm (SHA-1 deprecated)
- Missing intermediate cert in chain
🧠
Check your understanding
Module Quiz · 6 questions
Pass with 80%+ to mark this module complete. Unlimited retries. Each question shows an explanation.
Want this for your team?
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.
Book team training call
Replies in 4 working hrs · India-only · Senior consultants