Public Key Infrastructure (PKI) answers the question that makes HTTPS trustworthy: how do you know a public key really belongs to who it claims? The answer is a chain of trust rooted in Certificate Authorities.
The chain of trust
Root CA (trusted by your OS/browser)
└── signs → Intermediate CA
└── signs → example.com's certificateYour device ships with a list of trusted root CAs. A site's certificate is signed by a CA your device trusts, so a valid signature chain = "this key really is example.com's."
Key pieces
| Piece | Role |
|---|---|
| Certificate | Binds a public key to an identity, signed by a CA |
| CA | Vouches for certificates by signing them |
| CRL / OCSP | Ways to revoke a compromised certificate |
| Root store | The CAs your device trusts by default |
Why it matters (and its weakness)
PKI is why a green padlock means something — but it's only as strong as the CAs. A single compromised or rogue CA can issue valid certs for any site, which is why CA security and Certificate Transparency logs matter.
Related: The TLS Handshake · Digital Signatures · SAN Certificates on Ubuntu