PKI
PKI (public key infrastructure) is the system of certificate authorities, X.509 certificates, keys and revocation services that binds public keys to named identities, so that a server, device, person or workload can prove who it is with a private key. The certificate and revocation list profile used on the internet is RFC 5280. PKI underpins TLS, mTLS, code signing, smart cards and most machine identity.
| PKI component | Role |
|---|---|
| Root CA | Trust anchor, normally kept offline |
| Issuing (intermediate) CA | Signs end-entity certificates |
| Registration and issuance, often via ACME | Checks the request and automates issuance and renewal |
| Revocation (CRL, OCSP) | Tells relying parties a certificate is no longer valid |
| Certificate lifecycle management | Inventory, ownership and renewal across all of the above |
Enterprise PKI is where machine identity actually lives, and it is usually the least inventoried part of the estate: certificates issued by a forgotten internal CA, private keys copied between hosts, and no owner for the one that expires on a Sunday. Shrinking certificate lifetimes turn that from an annual annoyance into a continuous automation requirement.
See also: X.509, certificate lifecycle, what is machine identity, PKI vendors
Related on Start with Identity
- GlossaryProof of Possession (PoP)
Proof of possession (PoP) is a property of a token or credential that requires the presenter to show it controls a specific cryptographic key, so holding the to
- GlossaryDPoP
Demonstrating Proof of Possession (RFC 9449). Binds an access token to a specific key held by the client, so a stolen bearer token cannot be replayed. Important
- BlogLXD and MicroCloud flaw let attackers pose as any trusted client using only its public certificate
Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate
- GlossaryABAC
Attribute-Based Access Control. Access decisions are made by evaluating attributes of the subject, resource, action, and environment against policy. Flexible bu
- ArticleTop 6 Open-Source PKI and Certificate Management Tools
The best open-source PKI tools in 2026, from EJBCA and step-ca to Dogtag, cert-manager, OpenXPKI, and Boulder, compared on protocol support, automation, and who