Public key infrastructure

What it means

PKI, public key infrastructure, is a system of certificate authorities, certificates and keys that makes it possible to verify who a public key belongs to. Each user has a key pair: the private key they guard themselves, and the public key embedded in a certificate in which a trusted authority confirms their identity.

PKI underpins HTTPS on websites, the electronic signature, encrypted email and the certificates on an eID card. A browser or program trusts a certificate because it is signed by an authority on its trusted list, which vouches with its signature that the holder was verified.

In the EU the legal framework for PKI is the eIDAS regulation. Qualified trust service providers issue certificates with which a qualified electronic signature has the same effect as a handwritten one in every member state.

How it works in practice

Business owners meet PKI when signing filings to the state, contracts and accounting documents, logging into electronic services and running a website. Certificates have limited validity, so expiry dates must be watched and renewals made on time, otherwise the signature or website stops working.

A website needs only an ordinary SSL certificate, often free and renewed automatically. Signing contracts and filings requires a qualified certificate on a smart card or in a remote signing device. The difference lies in how thoroughly identity is verified and in the legal effect.

Larger companies run their own internal PKI to authenticate devices on the corporate network, for VPN or for signing internal documents. Managing the certificate authority's private keys is then critical; it belongs under privileged access controls and regular audits.

What to watch out for

All of PKI's security rests on protecting the private key. If the key falls into the wrong hands, for example from a poorly secured computer, an attacker can sign in the holder's name. A compromised certificate must be revoked with the issuer immediately.

When archiving electronically signed documents, remember that certificates expire and algorithms age. Long-term verifiability relies on timestamps and long-term preservation services, so that a signature can still be validated ten years later.