Overview
This lecture explains Public Key Infrastructure (PKI), its components, certificate types, and the trust model underpinning secure digital communication.
PKI Overview
- PKI (Public Key Infrastructure) manages the creation, storage, and distribution of digital certificates for secure communications.
- Digital certificates prove ownership of a public key using information, the owner's identity, and a digital signature from a trusted party.
Components of PKI
- The Certificate Authority (CA) issues, stores, and signs digital certificates, acting as a trusted validator.
- Registration Authority (RA) verifies the identities of entities requesting certificates, often functions together with the CA.
- A central certificate repository securely stores and manages certificates.
Certificate Types and Usage
- SSL/TLS server certificates are provided by web servers for secure connections; clients verify the certificate matches the server’s domain.
- Wildcard certificates use an asterisk to cover all host names in a domain.
- Self-signed certificates are signed by the issuing entity itself and are not trusted unless the public key is already trusted.
- SSL/TLS client certificates authenticate clients to servers, usually managed by internal CAs, not public CAs.
- Code signing certificates sign executable files so users can verify origin and integrity.
Trust Model and Certificate Hierarchy
- PKI relies on a "chain of trust" that starts with a root Certificate Authority (root CA).
- Root CA certificates are self-signed and form the trust anchor for all subordinate certificates.
- Intermediate (intermediary) CAs are granted signing authority by root CAs and can issue further certificates.
- End-entity or leaf certificates have no signing authority and are used at the endpoints of the trust chain.
- Trusted root CA certificates are pre-installed in operating systems and browsers to establish initial trust.
Key Terms & Definitions
- Digital Certificate — A file that links an entity to a public key, secured by a third-party digital signature.
- Certificate Authority (CA) — Trusted organization that issues, signs, and manages digital certificates.
- Registration Authority (RA) — Entity that authenticates certificate requests before CA approval.
- SSL/TLS Certificate — Digital certificate used to establish encrypted web connections.
- Wildcard Certificate — SSL/TLS certificate valid for all subdomains within a domain.
- Self-signed Certificate — Certificate signed by its issuer, not inherently trusted.
- Root CA — The top-level CA in the trust hierarchy, self-signed.
- Intermediate CA — CA certified by a root or another intermediate CA to sign additional certificates.
- End-entity/Leaf Certificate — Final, non-signing certificate used by servers or clients.
Action Items / Next Steps
- Review common certificate types and their use-cases.
- Understand how trust chains are established and maintained in PKI systems.