TechKnowSurge
TechKnowSurge Catalog Videos Public Key Infrastructure (PKI)
VideoSecurityFree

Public Key Infrastructure (PKI)

Public Key Infrastructure (PKI) establishes a chain of trust between web clients and servers by using certificate authorities to verify domain ownership and authenticate encrypted communications. It provides integrity, confidentiality, and message authenticity, though it does not guarantee that a verified server is free from malicious intent or compromise.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Public Key Infrastructure (PKI) is the trust framework underlying secure communication on the web, enabling clients to verify the identity of servers they connect to for the first time. The process begins when a web server owner contacts a registration authority to prove domain ownership, after which a certificate authority (CA) issues a digitally signed certificate using the CA's private key. When a client connects to that server, it receives the certificate and uses a root certificate already stored on its device — which contains the CA's corresponding public key — to validate the signature. A successful validation confirms the certificate is authentic and that subsequent communications are encrypted with the server's private key, establishing message integrity, confidentiality, and authenticity. It is important to distinguish authenticity from authentication: PKI confirms that a message originated from the server associated with a specific domain and private key, but it does not involve an interactive challenge to verify user or server identity beyond that. PKI does not constitute a complete security solution. Because any individual or organization can register a domain and obtain a valid certificate from a CA, a verified domain is not necessarily a trustworthy one — the server behind it may have been compromised or may be intentionally delivering malicious content. PKI advances security significantly by ensuring communications have not been tampered with and cannot be intercepted in plaintext, but it should be understood as one layer within a broader security architecture rather than an end-to-end guarantee of safety.

What you'll learn

What's covered

Public Key Infrastructure (PKI)

Key terms

Public Key Infrastructure
PKI
A framework of hardware, software, policies, and standards used to create, manage, and distribute digital certificates.
Certificate Authority
CA
A trusted entity that issues digital certificates used to verify the identity of individuals, organizations, or devices.
Digital Certificate
An electronic document that uses a digital signature to bind a public key with an identity.
Public Key
A cryptographic key that can be shared openly and is used to encrypt data or verify digital signatures.
Private Key
A secret cryptographic key used in asymmetric encryption to decrypt data or create digital signatures.
Asymmetric Encryption
An encryption method that uses a public key to encrypt data and a private key to decrypt it.
Router Advertisement
RA
An ICMPv6 message periodically broadcast by IPv6-enabled routers to announce their presence, advertise network prefixes, and provide default gateway information for SLAAC. Hosts also request RAs immediately on startup by sending a Router Solicitation.
Authenticity
The assurance that information or a communication originates from the claimed source and has not been fabricated or impersonated. Digital signatures and certificates are common mechanisms for establishing authenticity.

Topics

Public Key Infrastructure Certificate Authorities Cryptography Digital Certificates Public Key Cryptography Chain Of Trust

Transcript

One of the things that we use when it comes to the internet and the World Wide Web is public key infrastructure. Public key infrastructure gives us at least some idea of trust when it comes to these different servers that we're connecting into.

When we're browsing the web on some sort of app, we're connecting into servers that we may never have connected into before, and yet we're supposed to trust those servers. How do we do that? Public key infrastructure introduces one step into trusting these unknown servers. It's just one of the things that helps keep us safe on the internet, on the World Wide Web. Is it perfect? No. It doesn't do everything for us, but it does a big part of this.

It's really fascinating how PKI works — in fact, I have a whole module on this in my cryptography class because it is so fascinating and interesting. But what I'm going to do right now is just give a brief overview of PKI and what it does.

Getting a Certificate

What I have here is: let's say I have a web server, and the web server I run, clients are connecting in. The clients are going to nowadays receive an error if I don't have it as HTTPS, if I don't send things securely. Why? Because then anybody can intercept those messages and change them, or there's a lack of confidentiality — both of which could be a problem on my site.

So what we do here is I generate a public/private key pair, and then I turn in the public key. First of all, I need to contact the registration authority and prove who I am, so that they know that I own this techknowsurge.com web domain. Once I prove that I own this, then what happens is the certificate authority will then use their private key to create a certificate for me.

How the Client Verifies It

So this is one side of the equation: I get a certificate back, and now when a client connects into my website, they're going to receive messages back from me, and one of those messages will contain the certificate.

How does this client then know that they're connecting to me, techknowsurge.com? How can I prove that to them? They have a root certificate that's on their machine that has the public key associated with the private key of the certificate authority. What that public key does is it can decrypt what's called a hash or fingerprint that proves that this certificate is valid, which contains a public key that's associated with my private key. They can take that public key and decrypt this message, and if they can decrypt that message and it makes sense, then they know that this message was generated with this private key.

So that's a lot of keys and a lot of back and forths, but essentially what happens is that this user uses this root certificate to verify this certificate, which verifies the message and creates what's called authenticity.

Authenticity, Not Authentication

It's not authentication. Authentication would be like, hey, there's this back and forth to authenticate who you are. But it generates authenticity. What is authenticity? The authenticity is that this message was created and generated by, or at least encrypted by, this key right here, which has been essentially verified by this certificate authority. And then there's this trust that happens: this user trusts the certificate authority, so therefore it trusts messages that are coming from this server.

PKI Is Only Part of the Solution

Public key infrastructure is not the full solution, it's only part of the solution. The reason why is because anybody can go and buy a domain, be verified by a registration authority, and get a certificate back from a certificate authority. So here's the certificate, and they can pass that information along. What you've just done is you've proven your domain. So now when we make a connection to that domain, we at least have some legitimacy that this message has not been altered — it has integrity — cannot be viewed — it has confidentiality — and there's authenticity that it came from the server that has this private key.

So it takes us a good distance in making sure things are secure. But since anybody can get these domains, it's not 100% safe, because we're still connecting into a machine that might intentionally be sending malware to us, or maybe this machine has been compromised. So there's still concerns over this, but it at least gets us to the point where we have authenticity of the messages coming from a specific domain.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →