Cryptography › Module 2 › Lesson 3
Public Key Infrastructure (PKI)
Certificates, trust chains, and how PKI connects identities to public keys
Opening
Who says this public key is really cyberlium.com?
Anyone can generate a key pair and claim to be your bank. PKI answers: a Certificate Authority (CA) you already trust signs a certificate that says “this public key belongs to this name,” for a limited time.
1. Core Pieces
Certificate
A signed document: subject name, public key, validity dates, issuer.
CA (Certificate Authority)
Organization whose root/intermediate keys browsers and OSes trust.
Chain of trust
Server cert → intermediate(s) → trusted root. Browsers verify the chain.
Revocation
When keys leak, certs can be revoked (CRL/OCSP)—imperfect but important.
2. Why Defenders Care
Phishing sites fail when they lack a matching cert for the real domain (or users ignore warnings). Mis-issued certs, expired certs, and broken chains cause outages and security alerts. Understanding PKI helps you read TLS errors instead of blindly clicking through.
Name matching matters
A valid cert for evil-bank.example does not make evil-bank.example your real bank. Check the name in the address bar.
Knowledge Check
PKI primarily binds:
Multiple choice
Knowledge Check
True or False: Browsers trust website certificates through a chain ending at a root CA.
True or False
Knowledge Check
A certificate typically includes:
Multiple choice