What is PKI?

What is PKI?

Public Key Infrastructure (PKI) is a system of processes, technologies, and policies that allows you to encrypt and/or sign data. With PKI, you can issue digital certificates that authenticate the identity of users, devices, or services. These certificates work for both public web pages and private internal services (e.g., to authenticate devices connecting with your VPN, Wiki, Wi-Fi, etc.)

Why should my organization use PKI?

With Public Key Infrastructure (PKI), you can significantly increase the security level of your network. Three key benefits make this possible:

• Authentication: Validate identities to ensure only authorized users and devices have access to a server.
• Encryption: Use a certificate to create an encrypted session, so information can be transmitted privately.
• Data Integrity: Ensure any messages or data transferred to and from devices and servers are not altered.

How is PKI used?

Common use cases for PKI include, but are not limited to:

• Securing web pages
• Encrypting files
• Authenticating and encrypting email messages using S/MIME
• Authenticating nodes connecting to a wireless network
• Authenticating connections to your VPN
• Authenticating connections to sites and services containing corporate data using TLS mutual authentication

What’s end-to-end encryption?

End-to-end encryption is when a message is encrypted at your device, and the decryption is done at the recipient’s device. This means that no third party can intercept your sensitive data.

What is a CA?

A Certificate Authority (CA) is a trusted third party that verifies the identity of an organization applying for a digital certificate. After verifying the organization’s identity, the CA issues a certificate and binds the organization’s identity to a public key. A digital certificate can be trusted because it is chained to the CAs root certificate.

What is a digital certificate?

A digital certificate vouches for the holder’s identity. Like a driver’s license, the certificate has been issued by a trusted third party, cannot be forged, and contains identifying information.

What are public and private keys, and how are they related?

Public and private keys are used to encrypt and decrypt information. Only the private key can decrypt information encrypted by the public key. This key pair is known as asymmetric cryptography. The two keys are mathematically related, but it’s impossible to determine one key using the other.

What are public and private roots?

A root certificate provides the signature when binding an identity to the public key. This is how you identify whether a certificate is valid, and whether you should trust it.

Does DigiCert offer solutions for both public and private PKI?

The short answer is, yes. DigiCert offers solutions for both public and private PKI, along with a platform and RESTful API, which allow you to automate certificate management and customize PKI workflows. Issuing a private digital certificate with DigiCert is a fraction of the cost of a public certificate.

What’s MPKI?

Managed PKI (MPKI) is a solution provided by a CA that allows you to begin automating certificate processes and customizing PKI workflows. Once your organization requires a high volume of certificates, you’ll benefit from an MPKI solution that simplifies certificate management.

Should we set up an internal CA (build) or use a hosted CA (buy)?

You can secure your internal services using an internal CA — organizations commonly do this using Microsoft CA. However, building and maintaining an internal CA can be expensive and time-consuming. Many CAs provide hosted solutions that save you from some of the hardware, software, and personnel costs of building an internal PKI.

What is a Certificate Policy?

A Certificate Policy (CP) is a document created to identify the different actors of a PKI and their roles and duties. The CP specifies practices like how certificates can be used, how names are chosen, and how keys are generated. For in-depth information, see RFC 3647: https://tools.ietf.org/html/rfc3647

What is key storage and how should we handle it?

Key storage, often referred to as key archival, is securely storing the private key in case it’s lost. To meet FIPS compliance and ensure the highest level of security, we suggest storing your keys using a Hardware Security Module (HSM).

What is an HSM?

An HSM is a cryptographic hardware-based option for secure key storage. Typically HSMs are on-premises and require internal resources to maintain. Less expensive options exist — for example, Microsoft Azure Key Vault provides secure storage of keys in Microsoft’s cloud HSM.

How do I get started with building a PKI?

To get started, evaluate your environment by considering your needs and technology. We suggest these five steps:

• Identify your non-negotiable network security risks
• Pinpoint the network security risks PKI can mitigate
• Develop the right mix of public and private PKI
• Decide whether to build (internal CA) or buy (hosted CA)
• Determine how to automate delivery of certificates to devices

If you need help, contact one of our PKI architects at enterprise@digicert.com.