Public key infrastructure, or PKI, is often talked about as a type of cyber security technology or framework \u2014 but it\u2019s more than that. You likely know that the term relates to encryption, but do you actually know what it does or how PKI works?<\/p>\n\n\n\n
We\u2019re here to answer those burning questions relating to how public key infrastructure works. In the process, we\u2019ll break down the components of the public key infrastructure and how you might already be using PKI<\/a> each day to protect your business and customers.<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n Before jumping into the nitty-gritty details of how public key infrastructure works, let\u2019s first cover what PKI is to ensure we\u2019re all on the same page.<\/p>\n\n\n\n In a nutshell, public key infrastructure<\/a> is a system (based on encryption key pairs and digital certificates) that\u2019s used for securing communications between different computer systems.<\/strong> It\u2019s also a system that helps your organization remain compliant with regulatory data security and privacy requirements and avoid penalties, fines, and reputational loss.<\/p>\n\n\n\n There are two things PKI does to secure communications:<\/p>\n\n\n\n To better understand how PKI works, we first need to make this whole process all a more understandable. So, let\u2019s consider the SSL certificate that this website is using as an example. See the padlock icon in your browser? That means this website is using an SSL certificate, which is based on PKI. SSL uses PKI to do two things:<\/p>\n\n\n\n In a more technical sense, PKI<\/a> is a combination of cryptographic technologies, policies and procedures that you use to secure data in the digital world and to authenticate yourself. The term also relates to the issuance, use, storage, distribution, management, and revocation of digital certificates and keys \u2014 also known as the certificate lifecycle \u2014 as well as the entities that issue them.<\/p>\n\n\n\n In a roundabout way, what all of this means is that public key encryption is a two-key (asymmetric) cryptosystem that protects everything you do and the information you send and receive online.<\/strong> From the ecommerce transactions on your website to the emails that you send within your organization that contain sensitive information, the data is secure thanks to PKI<\/p>\n\n\n\n The main function of PKI<\/a> is to distribute public keys to the right devices, software, and users who need them. This means that<\/strong> PKI is all about ensuring that your sensitive data doesn\u2019t fall into the wrong hands.<\/strong><\/p>\n\n\n\n To better understand how PKI works, you first need to know what’s involved in it. Of course, there are several critical components within the public key infrastructure \u2014 and we\u2019ll dive into each of these topics more in depth a little later in the article:<\/p>\n\n\n\n If you want more information about what PKI is<\/a>, I\u2019d suggest you check out the articles my colleagues wrote about it and how it facilitates trusted, secure communication<\/a>. They\u2019ve already done a great job of it, and I\u2019m not trying to reinvent the wheel here.<\/p>\n\n\n<\/span><\/span>\n\n\n\n Okay, so now that you know what PKI is and how it relates to public key cryptography, it\u2019s time to talk about what it does and how it does it. There are a few key things to know about how PKI works:<\/p>\n\n\n\n Of course, doing any of these things requires the use of public encryption keys that have strong entropy<\/a>. Every key is a randomly generated string of binary numbers \u2014 a random series of 1s and 0s \u2014 that\u2019s used to determine how plaintext transforms into ciphertext. So, when we talk about entropy, what we mean is that the keys are generated with enough randomness that it would take thousands \u2014 if not millions \u2014 of years for even modern supercomputers to guess.<\/p>\n\n\n\n The first part of the PKI process is authentication. Through the use of digital certificates (such as client certificates and SSL\/TLS certificates), you can authenticate yourself, your client, or your server using asymmetric encryption. (Again, asymmetric encryption is that two-key pair of public and private keys.)<\/p>\n\n\n\n Let\u2019s consider a simple step-by-step explanation of how authentication works using the following scenario of someone connecting to Amazon.com:<\/p>\n\n\n\n To facilitate this this process (and to create a secure, encrypted connection eventually), the user\u2019s web client and your server begin what\u2019s known as an SSL or TLS handshake<\/a>. This process, which mitigates the risk of man-in-the-middle (MitM) attacks and eavesdropping, allows the client to:<\/p>\n\n\n\n But what if the server wants to authenticate you as the user? That\u2019s possible, too. In that case, you\u2019ll need a certificate (a client certificate, or what\u2019s known as an email signing certificate) that\u2019s issued by a CA the server trusts. A similar process happens (but in reverse) with the server checking your digital certificate before allowing you to access the applications or content on the server.<\/p>\n\n\n\n The way that public key infrastructure works is that it uses asymmetric, mathematically related keys to encrypt and decrypt data. Basically, we\u2019re talking about taking a message that you can read (plaintext) and scrambling it into an undecipherable format (ciphertext). Then it needs to be unscrambled, or deciphered, when it reaches the other party.<\/p>\n\n\n\n An easy-to-understand encryption is an old-fashioned shift cipher (substitution cipher), or what\u2019s more commonly known as the Caesar cipher.<\/p>\n\n\n\n In this type of encryption, plaintext letters \u201cshift\u201d a set number of spaces depending on the secret key. For example, the word \u201cCERTIFICATE\u201d becomes the ciphertext \u201cIKXZOLOIGZK\u201d if your key is \u201c6\u201d because you\u2019ve shifted each letter six spaces.<\/p>\n\n\n\n Of course, this is encryption in one of its most basic forms. Modern cryptographic techniques have come a long way from the days of ancient Rome where notes were delivered by horse or boat. After all, we now have supercomputers and technology on our side to help us encrypt (and decrypt) data, messages, and other sensitive information.<\/p>\n\n\n\n The way that encryption works in the PKI context is that data gets encrypted by a public key and decrypted by its corresponding private key.<\/p>\n\n\n\n But that isn\u2019t the only trick PKI has up its sleeve. Another function of PKI is that it enables the generation of symmetric encryption keys as well. Although symmetric keys are considered less secure than their asymmetric counterparts, they\u2019re invaluable because they make communication faster and require less processing power. Without diving deep into the details, PKI lets you have the best of both worlds \u2014 the security of asymmetric encryption and the simplicity of symmetric encryption. <\/p>\n\n\n\n When we talk about data states, we aren\u2019t talking about locations. There are three main states of data \u2014 data in transit, data at rest, and data in use. For the purpose of this article, however, we\u2019re just going to talk about two of those data states here. Why? Because even though it\u2019s possible to run computations on encrypted data in use through something called homomorphic encryption<\/a> (more specifically fully homomorphic encryption), it\u2019s a slow process that doesn\u2019t scale well using current technologies. So, we\u2019re going to put a pin in that one for now and focus on the other two data states.<\/p>\n\n\n\n Regardless of whether or not you know it, encryption is in use all around you to secure data in transit and data at rest:<\/p>\n\n\n\n Here\u2019s an illustration of how installing an SSL\/TLS certificate on a server facilitates a secure, encrypted connection between a website visitor\u2019s client and the web server it connects to.<\/p>\n\n\n\n One of the most critical aspects of how public key infrastructure works is that it helps to ensure that data comes from a legitimate source and hasn\u2019t been altered in any way. One of the ways it does this is by giving you the ability to apply a digital signature to your email, software, or files. Furthermore, every digital certificate itself is signed using the CA\u2019s private key.<\/p>\n\n\n\n Basically, what a digital signature<\/a> does is inform the user or their client about whether a file, email, or document:<\/p>\n\n\n\n Don\u2019t worry, we aren\u2019t going to get into all of the specifics of hashing and checksums<\/a> here. Frankly, it\u2019s too involved and we still have other things to talk about relating to how PKI works.<\/p>\n\n\n\n Digital certificates are the data files that help you (or a client or server) to authenticate to another computer system and protect the integrity of your data. Digital certificates come with different levels of validation:<\/p>\n\n\n\n When discussing how PKI works, you have to talk about the data files that are integral to the system. There are several types of X.509 digital certificates that can protect data in different situations, depending on your needs:<\/p>\n\n\n\n When diving into an in-depth topic about how PKI works, then it\u2019s vital to talk about the roles and responsibilities of third-party CAs. A certificate authority<\/a>, like Sectigo or DigiCert, is a trusted third party that\u2019s responsible for issuing and managing the private keys and certificates that support PKI. (The exception here would be that they don\u2019t see or touch the private keys of leaf certificates [with the exception of EV document and code signing certificates].)<\/p>\n\n\n\n Although there are a few dozen CAs in existence around the world, there is only a handful of them that control the lion\u2019s share of the market.<\/p>\n\n\n\n Now, to be considered publicly trusted, a CA must adhere to a set of baseline requirements that are outlined by the industry\u2019s governing body, which is known as the CA\/Browser Forum<\/a> (CA\/B Forum).<\/p>\n\n\n\n Before a CA can issue any type of digital certificate or private key, they first must verify the information that\u2019s provided by the person or organization requesting it using official sources. They can do this themselves or, in cases where a certificate is ordered via a subordinate CA, this is where a registration authority<\/a> (RA) comes into play.<\/p>\n\n\n\n Simply put, an RA is a network authority that acts as an intermediary between CAs and the organizations or individuals who request certificates from them. They\u2019re responsible for handling certificate issuance requests from individuals and organizations like yours on an individual basis and verifying the information you provide. In these scenarios, registration authorities play an integral role in the chain of trust.<\/p>\n\n\n\n The effectiveness of public key infrastructure rests upon the validity of what\u2019s known as a certificate chain, or the chain of trust. The chain of trust refers to a series of digital certificates that leads back from your individually assigned certificate to the certificate authority who signed off on it. If an RA is involved, they\u2019d be the \u201cmiddleman\u201d between you and the CA.<\/p>\n\n\n\n There are typically three components to the chain of trust \u2014 root, intermediate, and leaf (server) certificates. It\u2019s easiest to think of these components in terms of a tree.<\/p>\n\n\n\n (To view the chain of trust for your SSL\/TLS certificates, click on the padlock icon in your browser, navigate to the certificate information, and click on the \u201cCertificate Path\u201d tab.)<\/p>\n\n\n\n A root certificate, which is also known as a trusted root, is the heart of public key infrastructure. Every CA issues only a handful of root certificates, and they are pre-downloaded into the trust store or root store within most browsers and operating systems. Their corresponding public keys are pre-downloaded as well to a device\u2019s key store.<\/p>\n\n\n\n So, why is this certificate so important to PKI? Any certificate that\u2019s signed by a trusted root certificate is considered valid automatically by all of the major operating systems and browsers. Each browser or operating system gets to choose which root certificates to include by default. <\/p>\n\n\n\n An intermediate certificate is the go-between (it serves as an intermediary, hence the name) that lies between a trusted root certificate and a leaf certificate. Basically, it\u2019s a buffer between the two that\u2019s issued by an intermediate CA.<\/p>\n\n\n\n Because certificate authorities want to keep their root certificates safe, they typically use intermediate certificates to issue the leaf certificates. Since root certificates can be stored offline, this means that once they sign the intermediate certificates, they aren\u2019t needed again and can be kept in a safe location. This helps CAs to ensure that their root certificate private keys are safe and not readily accessible to cybercriminals.<\/p>\n\n\n\n A leaf certificate, or end user certificate as it\u2019s sometimes called, is basically the certificate that gets issued to your specific domain. This type of cert has a much shorter lifespan \u2014 certificates issued prior to Sept. 1, 2020 have two-year lifespans, whereas any certificates that will be issued on or after that date will be limited to one year.<\/p>\n\n\n\n Although this should go without saying, I\u2019m going to say it anyhow (because, inevitably, someone always misses this memo): Your certificates are good only for as long as they are valid.<\/strong><\/p>\n\n\n\n It\u2019s amazing how many people seem to always miss this memo. If your certificate is invalid \u2014 which could occur due to improper installation or configuration, certificate expiry, or the unlikely revocation by the issuing CA, it means that your website is no longer secure. Even worse, your entire system can go down as a result. Check out our blog \u201cThis Is What Happens When Your SSL Certificate Expires<\/a>\u201d for a few examples (from brands you\u2019ll recognize!)<\/p>\n\n\n\n Regardless of the reason, it\u2019s important that you stay on top of these issues. You can do this by adhering to certificate and key management best practices<\/a> and by using reliable management tools. These tools provide visibility into your network for all certificates and helps you to track and manage their lifecycles, which involves the issuance, use, storage, distribution, management, and revocation of digital certificates and keys. This way, you can reissue certificates before they expire or stay abreast of any revocations that come down the pipeline.<\/p>\n\n\n<\/span><\/span>\n\n\n\n For virtually any modern business, having secure communications and access to reliable data are key to your success. But how does PKI work to help secure your business and its invaluable data? Public key infrastructure makes it possible for your organization to:<\/p>\n\n\n\nBefore We Can Answer \u201cHow Does PKI Work?\u201d Let\u2019s First Break Down What It Is\u2026<\/h2>\n\n\n\n
\n
\n
The Nitty-Gritty: The 6 Key Components of PKI<\/h3>\n\n\n\n
\n
\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/07\/how-pki-works-overview.png\")
How Does Public Key Infrastructure Work?<\/h2>\n\n\n\n
\n
PKI Works By Authenticating Users and Servers<\/h3>\n\n\n\n
\n
\n
![\"TLS](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/01\/SSL_Handshake_10-Steps-1-897x1024.png\")
![\"Graphic](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/03\/TLS_1_3_Handshake.jpg\")
PKI Works by Encrypting Data (or the Connections That Your Data Transmits Through)<\/h3>\n\n\n\n
How Encryption Works<\/h4>\n\n\n\n
![\"Shift](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/07\/caesar-cipher-shift.png\")
More Specifically, How PKI Encryption Works<\/h5>\n\n\n\n
How to Apply Encryption to the Different States of Data<\/h4>\n\n\n\n
\n
![\"How](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/07\/how-pki-works-https-connection.png\")
PKI Works by Ensuring Data Integrity<\/h3>\n\n\n\n
\n
Validation and Functionalities: What Each Type of Digital Certificate Helps You to Achieve<\/h2>\n\n\n\n
\n
\n
Where Certificate Authorities Fit Into the PKI Picture<\/h2>\n\n\n\n
![\"Screenshot](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/07\/how-pki-works-windows-root-store-1024x549.png\")
What Is the Chain of Trust?<\/h3>\n\n\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/07\/how-pki-works-certificate-chain-of-trust.png\")
Root Certificates (Roots and Trunk of the Tree)<\/h4>\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/07\/how-pki-words-trusted-root-example-1.png\")
Intermediate Certificates (Supportive Tree Branches)<\/h4>\n\n\n\n
Leaf (Server) Certificates (Leaves and Smaller Tree Branches)<\/h4>\n\n\n\n
For PKI to Work, Proper Certificate and Key Management Is a Must<\/h2>\n\n\n\n
How PKI Works to Protect Your Business<\/h2>\n\n\n\n