Catalog
concept#Security#Architecture#Governance#Integration

Public Key Infrastructure (PKI)

PKI is a model for managing cryptographic keys and certificates to secure communication and identities.

Public Key Infrastructure (PKI) is an infrastructure model for managing digital certificates and public/private keys, enabling confidentiality, integrity and authenticity.
Established
High

Classification

  • High
  • Technical
  • Architectural
  • Advanced

Technical context

Web servers (Apache, Nginx) for TLSHardware Security Modules (HSM) or cloud KMSIdentity and device management systems (AD, MDM)

Principles & goals

Centralize trust anchors and define clear CA roles.Separate root CA from operational signing (air-gapped root/sub-CA).Automate lifecycle, renewal and revocation wherever possible.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Theft or compromise of private CA keys.
  • Misconfigured trust chains or incorrect certificate issuance.
  • Insufficient revocation mechanisms lead to prolonged trust violations.
  • Use air-gapped root CA with signing subordinate CAs for operations.
  • Use HSMs or certified KMS for key custody.
  • Automate renewal and monitoring to reduce human errors.

I/O & resources

  • Definition of trust anchors and CA policies
  • Infrastructure for key management (HSM, KMS)
  • Automation tooling (ACME, PKI APIs) and monitoring
  • Issued and managed certificates (X.509)
  • Audit-proof records of issuance and revocation
  • Automated renewal and revocation processes

Description

Public Key Infrastructure (PKI) is an infrastructure model for managing digital certificates and public/private keys, enabling confidentiality, integrity and authenticity. It comprises certificate authorities, registration authorities, certificate lifecycle and trust models and is embedded in numerous standards and protocols.

✔

  • Ensures encryption, authenticity and integrity via trust chain.
  • Central policies for key and certificate management.
  • Automatable processes reduce operational effort and errors.

✖

  • Operational and governance complexity, especially in large organizations.
  • Dependence on correct implementation and secure key custody.
  • Misuse or compromise of a CA has wide-ranging consequences.

  • Certificate lifetime

    Average validity period of issued certificates; influences renewal effort and risk.

  • Rate of renewed/expired certificates

    Share of certificates renewed in time versus expired certificates.

  • Mean Time To Recover (MTTR) after CA incident

    Time to restore trusted state after a CA compromise incident.

Let's Encrypt

A free public CA using ACME to automate issuance and renewal of TLS certificates.

Enterprise internal PKI with HSM

Large company operates an internal CA with HSMs for key custody and strict policies.

Smallstep / automated DevOps certificates

Open-source tooling to automate certificate lifecycle in cloud-native environments.

1

Design: define trust models, policies, roles and compliance requirements.

2

Set up infrastructure: root/sub-CA, HSM/KMS, backups and offline procedures.

3

Automation and monitoring: integrate ACME/PKI APIs, configure renewal, revocation and alerts.

⚠️ Technical debt & bottlenecks

  • Legacy certificates with long lifetimes blocking renewal.
  • Lack of automation leads to manual workarounds.
  • Non-standard certificate formats in internal systems.
Key managementRevocation performanceHSM / hardware dependencies
  • Issuing certificates without identity verification.
  • Using deprecated algorithms (e.g. SHA-1) for signatures.
  • Failing to provide revocation information (no OCSP/CRL).
  • Underestimating effort for revocation and monitoring infrastructure.
  • Complex trust chains cause client inconsistencies.
  • Missing procedures for emergency rotation of compromised keys.
Knowledge of cryptography and X.509 standardsOperational experience with CA software and HSMsAutomation and DevOps skills (ACME, APIs)
Security requirements: encryption, signature, authenticityScalability: automated issuance and renewalCompliance and auditability: evidence of key management
  • • Regulatory requirements for key strength and retention
  • • Compatibility with existing protocols and clients
  • • Budget and operational effort for secure key management