Public Key Infrastructure

Public Key Infrastructure (PKI) answers the question that makes HTTPS trustworthy: how do you know a public key really belongs to who it claims? The answer is a chain of trust rooted in Certificate Authorities.

#The chain of trust

Root CA (trusted by your OS/browser)
   └── signs → Intermediate CA
          └── signs → example.com's certificate

Your device ships with a list of trusted root CAs. A site's certificate is signed by a CA your device trusts, so a valid signature chain = "this key really is example.com's."

#Key pieces

#Why it matters (and its weakness)

PKI is why a green padlock means something — but it's only as strong as the CAs. A single compromised or rogue CA can issue valid certs for any site, which is why CA security and Certificate Transparency logs matter.

Related: The TLS Handshake · Digital Signatures · SAN Certificates on Ubuntu