Public key infrastructure manages the keys and certificates that make encrypted communication work. It includes certificate authorities, registration authorities, policies, and the software that issues, distributes, and revokes certificates. When your browser trusts an HTTPS site, PKI is the reason. The site presented a certificate. A trusted CA signed it. The browser verified the signature against its list of trusted roots. The chain of trust holds because everyone agrees on who the CAs are.

PKI is complex and fragile. A compromised CA can issue fraudulent certificates for any domain. DigiNotar in 2011 and Symantec over several years both misissued certificates. Browsers eventually distrusted them, and the companies collapsed. Certificate revocation is another weak point. Checking whether a certificate has been revoked is slow and unreliable. Some browsers skip the check entirely. Certificate transparency logs improve the situation by recording every issued certificate publicly. Misissuance gets caught faster. But the trust model remains centralized. A handful of root CAs anchor the security of the entire web. Compromise one and the damage is global.

PKI components

• Certificate authority — issues and signs certificates
• Registration authority — verifies identity before issuance
• Certificate repository — stores and distributes certificates
• Revocation system — publishes revoked certificates
• Certificate transparency — public logs of issued certificates

PKI is invisible when it works. When it fails, the entire web feels it.