Public Key Infrastructure (PKI) 🌐🔒

Overview of PKI 🛡️

• Definition:

  • PKI is a framework for managing digital certificates and public-key encryption, crucial for securing communications on the Internet.

  • Components: PKI involves the creation, storage, and distribution of digital certificates.

Digital Certificates 📜

• Purpose:

  • A digital certificate verifies that an entity owns a particular public key.

  • Contents:

    • Public key

    • Entity information

    • Digital signature from a Certificate Authority (CA) confirming the validity.

• Trust Model:

  • If the certificate's signature is valid and trusted, the public key can be used for secure communication.

Certificate Authority (CA) & Registration Authority (RA) 🏛️

• CA:

  • Responsible for issuing and signing certificates.

  • Ensures the integrity and authenticity of certificates.

• RA:

  • Verifies the identities of entities requesting certificates.

  • Often combined with CA roles for simplicity.

Certificate Types 🔐

• SSL/TLS Server Certificate:

  • Used to establish secure connections between a web server and client (e.g., web browsers).

  • Ensures that the client can trust the server's identity.

  • Wildcard Certificates: Valid for multiple hostnames within a domain.

  • Self-Signed Certificates: Signed by the same entity that issues them, less trusted without prior endorsement.

• SSL/TLS Client Certificate:

  • Used to authenticate the client to the server.

  • Typically issued by an internal CA, not a public one.

• Code Signing Certificates:

  • Used to sign executable programs to verify their integrity and origin.

  • Helps users ensure that applications are not tampered with and come from the legitimate author.

Chain of Trust 🔗

• Root Certificate Authority:

  • The starting point of the trust chain.

  • Self-signed because no higher authority can validate them.

  • Signs other certificates and creates a hierarchical structure.

• Intermediate CAs:

  • Subordinate to the root CA.

  • Can sign additional certificates and extend the chain of trust.

• End-Entity (Leaf) Certificates:

  • Issued to end-users or applications.

  • Represents the final point in the certificate hierarchy without additional signing authority.

Trust Distribution 🌍

• Root CA Distribution:

  • Trust in root CAs is established through pre-installed root certificates in operating systems and browsers.

  • Major OS vendors and browsers distribute and manage these certificates to bootstrap the chain of trust.

🔒📜🔗