Public Key Infrastructure (PKI)

What it is

PKI is the collection of certificates, issuing certificate authorities (CAs), key management, and revocation mechanisms that let a party prove who it is and that it holds the corresponding key. It is the trust backbone for HTTPS (see security:tls), email signing/encryption, code signing and device identity.

Why it matters

Attacks on PKI are attacks on trust itself: a mis-issued or trusted-but-abused certificate lets an attacker impersonate a legitimate service. Understanding certificate chains lets you tell a real site from an impostor and catch a compromised or misconfigured CA.

How it works

• Certificate: binds a public key to an identity; signed by an issuing CA.
• Chain of trust: the client validates leaf → intermediate → root, checks hostname match, validity period, and revocation.
• Revocation: CRLs or OCSP signal certificates that should no longer be trusted (e.g., after key compromise).
• Email: S/MIME and DKIM rely on PKI-related trust for signing (see security:email-security).

Detection

• Certificate errors, unexpected hostname mismatch, or an unusual trusted root suddenly validating a service.
• Certificates issued to a domain that does not legitimately use them.
• A fixed/pinned certificate changing out-of-band without a maintenance window.

Mitigation

• Always validate the full chain, hostname and revocation in clients.
• Use and enforce HTTPS with valid, publicly trusted certs; avoid self-signed in production.
• Monitor certificate transparency/telemetry for mis-issued certs for your domains.
• Rotate and revoke keys promptly on suspected compromise.

Investigation

In an interception or impersonation investigation, capture the presented certificate chain and compare against the expected issuer and fingerprint; pivot to DNS/hostname history. Relevant tool: security:tls and email-header review.