概念概述
公钥基础设施（PKI）（Public Key Infrastructure）指的是：PKI 通过权威机构签发的证书把公钥与身份绑定，使素未谋面的双方建立信任，支撑 TLS、客户端证书与代码签名。
从更严格的定义看，Public key infrastructure is the combination of certificate authorities, registration procedures, certificate formats, and revocation mechanisms that vouch for the binding between a public key and an identity. 该概念在工程实践中的价值，在于它能帮助团队用统一的语言描述一个具体的质量属性或设计约束，从而在评审与协作中减少歧义。
为什么需要它
It underlies TLS server authentication, client certificates, code signing, and internal service identity. 它与 XML External Entity Injection、NoSQL Injection、LDAP Injection 等概念经常一起出现，用于解决相近的工程问题。理解它的适用场景，有助于在多种备选方案之间做出有依据的取舍，而不是凭直觉选择技术方案。
常见误解
- a certificate proves a key is secure rather than that an identity vouches for it
- revocation is checked automatically for every connection
需要避免的反模式
- trusting a private or enterprise CA whose lifecycle is unmanaged
- issuing long-lived certificates for automation that could rotate them
实践要点
- A certificate authority signs a certificate asserting that a public key belongs to a named subject, and relying parties accept it only if they trust that authority.
- Trust is transitive through a chain up to a root in the trust store, so a poorly governed intermediate can undermine every certificate beneath it.
- Revocation is the weak point: browsers frequently soft-fail on revocation checks, which is why short-lived certificates and transparency logs are favoured.