阅读中文版本

Public Key Infrastructure

PKI binds public keys to identities through certificates signed by authorities, letting parties that have never met establish trust.

Definition

Public key infrastructure is the combination of certificate authorities, registration procedures, certificate formats, and revocation mechanisms that vouch for the binding between a public key and an identity.

It underlies TLS server authentication, client certificates, code signing, and internal service identity. Compared to simpler alternatives, this concept fits best when the trade-off it represents is the one the system actually cares about.

When to use it

A common use case is applying it at the boundary where the cost of getting it wrong is highest, and the scenario usually involves a concrete guarantee the system must uphold. Unlike an ad hoc approach, it makes that guarantee explicit, reviewable, and testable.

How it works

A certificate authority signs a certificate asserting that a public key belongs to a named subject, and relying parties accept it only if they trust that authority.

Trust is transitive through a chain up to a root in the trust store, so a poorly governed intermediate can undermine every certificate beneath it.

Trade-offs and alternatives

Revocation is the weak point: browsers frequently soft-fail on revocation checks, which is why short-lived certificates and transparency logs are favoured. The main drawback is the extra complexity it introduces, so the benefit should clearly outweigh that cost before a team adopts it.

Common misconceptions

A persistent misconception is that a certificate proves a key is secure rather than that an identity vouches for it. Another is that revocation is checked automatically for every connection. For example, an engineer who assumes otherwise may design around a guarantee that does not actually exist, which only becomes obvious under load or failure.

Anti-patterns to avoid

Two recurring anti-patterns are to trusting a private or enterprise CA whose lifecycle is unmanaged and to issuing long-lived certificates for automation that could rotate them. Both tend to surface as hard-to-debug production issues rather than obvious test failures. Related concepts include XML External Entity Injection, NoSQL Injection, LDAP Injection.