What is PKI? The Ultimate Guide to Public Key Infrastructure

Public key infrastructure (PKI) is critical for modern network security. A PKI enables passwordless authentication and encrypted communication, and it has been listed by organizations such as CISA, NSA, and NIST as foundational for a modern, zero-trust security framework.

PKI certificates are complicated, and even very senior security admins may find them difficult to understand. This guide covers:

• What is a PKI?
• How does it work?
• Why is it so important?
• Why can it be so difficult to manage on your own?

What Is a PKI (Public Key Infrastructure)?

Public key infrastructure (PKI) is the set of processes and technology that manage digital certificates and public-key encryption. A digital certificate, or PKI certificate, enables secure digital communication by acting as a digital passport to bind a public key to an entity such as a device, person, or server.

At a very high level, the purpose of PKI infrastructure is to allow organizations to use encryption for their various security needs. It provides phishing-resistant authentication for applications or Wi-Fi, and enables your web servers to communicate in encrypted tunnels.

PKI infrastructure and digital certificates are incredibly important and technologically advanced facets of cybersecurity. We’ll break down how they work in the following sections.

How Does Public Key Infrastructure (PKI) Work?

A PKI certificate system enables organizations to generate cryptographic key pairs based on mathematically hard problems (such as integer factorization or elliptic curve discrete logarithms).

Cryptography is key to the secure transfer of information in the modern world, from logins to ecommerce, email exchanges, and IoT communication.

Cybersecurity specialists depend on data encryption to protect information by moving across vulnerable networks and scrambling readable data into an unrecognizable format. Decryption reverses that process, restoring the original content for authorized recipients. Together, they form the foundation of trustworthy digital communication.

There are two types of encryptions:

• Symmetric
• Asymmetric

PKI uses asymmetric encryption. Here’s a quick explanation of both types of encryptions, and why asymmetric is the more secure option:

Symmetric Encryption (Private Key Cryptography)

Symmetric encryption uses a single key to encode a message. The message can only be decoded by someone who has their own copy of the key. This works great in theory, but the moment that single key is compromised, every packet is easily decoded by anyone with a copy of the key.

Asymmetric Encryption (Public Key Cryptography)

Asymmetric encryption, also known as Public Key Encryption, is a more secure method of encryption, and it’s used in public key infrastructure. It uses two keys, a private key and a public key. Messages are encoded with a public key, which is shared and available to anyone, but only the person with the private key can decode the message.

Proper key management is not an ancillary concern within these systems. It is a core requirement, and it sits at the heart of any well-implemented cryptographic framework, ensuring that as networks scale, the underlying data stays protected against unauthorized access.

Example of Asymmetric Encryption

The classic way of explaining asymmetric encryption is the Alice and Bob diagram.

 

The core of how a PKI infrastructure achieves strong asymmetric encryption is simply brilliant mathematics. It revolves around taking two huge prime numbers (on the order of 2^512!) and factoring them, but trying to explain the process in just one sentence is almost impossible. We recommend watching these two videos to gain a better understanding:

• Public Key Cryptography ← how public key infrastructure works at a high level
• Diffie Hellman – The Mathematics ← the math behind asymmetric encryption

Why Is PKI Infrastructure Important for Cybersecurity?

PKI infrastructure matters for cybersecurity because it binds identities to public keys using certificates issued by a trusted certificate authority (CA) as a source of truth. When integrated with authentication systems such as 802.1X, VPN gateways, or mutual TLS, PKI enables strong identity validation before access is granted. This added security ensures only the identities who are authorized to access resources can do so.

Here’s how PKI encryption enhances network security in an organization:

Validates Trustworthiness of Users & Devices

Each user or device is issued a PKI certificate by a trusted CA, which confirms their identity. When they attempt to access the network, they prove their identity by confirming possession of the private key without needing to reveal it. This process makes it much harder for attackers to impersonate someone or use stolen credentials.

Leverages EAP-TLS In WPA2-Enterprise Network

Digital certificates provide enhanced security for mutual EAP-TLS 802.1X authentication on a WPA2-Enterprise network. They provide the framework for the EAP-TLS protocol, which enables faster and more secure authentication through mutual authentication between clients and servers.

Protects Remote Cloud Environment

With certificate-based 802.1X authentication, users and devices can connect to a remote server without the risk of stolen or leaked passwords that could compromise the entire network.

A certificate management system tied to a PKI automates the certificate lifecycle for managed, BYOD, and guest devices. This allows administrators to continuously monitor who has access to the network, whether it is wired or wireless. This ensures only authorized personnel can access specific data and applications, preventing unauthorized access to confidential information.

The table below explains the key differences between a password-based network and a PKI-based network:

Features	Password-Based Network	PKI-Based Network
Security Risk	Shared keys come with a high risk of phishing, brute force, and MITM* attacks.	No pre-shared keys lower risk.
Authentication Factor	Weaker trust since passwords can be stolen or duplicated.	Stronger continuous device trust with certificate-based authentication
User Experience	Clunky and needs multiple resets, reset-based disconnects.	Certificates can be used until they are revoked or expire.
Context-Based Trust	Limited, static device trust.	Identity and access-based granular trust model.
*MITM: Man in the middle

What Is a PKI Certificate?

A PKI certificate should be thought of as a passport. It’s a phishing resistant form of verifying your identity with a trusted third party, and one of the most surefire ways organizations can ensure their authentication mechanisms are phishing resistant.

This digital certificate lives on your device and is presented to systems during authentication. One common way digital certificates are used is to show an Identity Provider like Microsoft Azure or Okta that you are a particular user using a specific device. The below video shows what it looks like using a digital certificate with Okta.

What Are the Components of Public Key Infrastructure?

The components of a public key infrastructure are sometimes debated, as there have been a lot of recent developments in the field of PKI certificates. In our opinion, the components of a public key infrastructure comprise everything your organization needs to manage the entire certificate lifecycle. We consider these components to be critical parts of a modern public key infrastructure:

• Certificate Authority (CA)
  • Root Certificate Authority
  • Intermediate Certificate Authority
• Certificate Templates
• Certificate Lifecycle Management
  • Certificate Policies
• Hardware Security Module

In the following sections, we’ll summarize each of these PKI components. CRL and OSCP are explained later in

Certificate Authority (CA)

A certificate authority (CA) is trusted to issue digital certificates that confirm the subject imprinted on the certificate is the owner of the public key. In PKI management, the client generates a public-private key pair. The public key and information to be imprinted on the certificate are sent to the CA. The CA then creates a digital certificate consisting of the user’s public key and certificate attributes. The CA signs the certificate with its private key.

The certificate trust chain is a multi-level hierarchy of trust. You can trace the chain from the client’s certificate all the way back to a single Root CA. Every chain ends with a person (or company) from which all trust is ultimately derived.

Root Certificate Authority

A root certificate authority (Root CA) is a trusted CA that is entitled to verify the identity of a person and signs the certificate that is distributed to a user. Your trusted Root CA needs to be handled delicately, because if it’s compromised, then all the trust in your PKI key fails. These trusted root certificates do not issue your end user’s digital certificates directly but instead issue Intermediate CAs that subsequently issue the client certificates. Since Root CAs are sensitive, they are almost always stored in a very secure manner, away from the public internet.

Intermediate Certificate Authority

An intermediate certificate authority (Intermediate CA) is also a trusted CA and is used as a chain between the Root CA and the client certificate that the user enrolls for. Since the Root CA has signed and trusts the Intermediate CA, certificates that are generated from the Intermediate CA are trusted as if they were signed by the Root CA. As a best practice, always issue certificates from an Intermediate CA.

Certificate Templates

Certificate templates are used to determine how a certificate is structured and what it will be used for. For public key infrastructures such as Active Directory Certificate Services (AD CS), certificate templates are enormously important and dictate much of the permissions required for receiving a certificate and what it will be used for. Exploiting a misconfigured certificate template in AD CS is one of the most common compromises.

Below is an example of a Default Certificate Template in the SecureW2 PKI. You can see attributes such as Validity Period, Signature Algorithm, Extended Key Usage (EKU, or what the certificate will be used for), and much more!

Certificate Lifecycle Management

A certificate management system is a very important part of PKI management. Lifecycle management encompasses all phases of the certificate lifecycle, which can be broken down into the following phases:

1. Certificate Enrollment – An entity submits a request for a certificate to the certificate authority. An entity can be a person, a device, or even just a few lines of code.
2. Certificate Issuance – The CA needs to validate the identity of the applicant, which is typically done through credentials or by trusting another CA that has already validated the applicant.
3. Certificate Validation – During authentication, the RADIUS server validates the certificate against its trust store and checks revocation status using certificate revocation list (CRL) or Online Certificate Standard Protocol (OCSP) to confirm that the certificate is still valid and hasn’t expired or been revoked.
4. Certificate Revocation – Certificates contain an expiration date that’s specified when they are first issued. When that date is reached, the certificate will automatically be considered invalid for any authentication attempt. Certificate revocation can occur through a CRL, a Delta CRL, or OSCP.
5. Certificate Renewal – Instead of automatically being shunted to a CRL, some CAs have settings that renew certificates upon expiration date, though typically they re-verify identity. At this time, you can choose whether to generate a new key pair – effectively making it a totally new certificate.

Effectively managing certificates can be simple if you have a proper automation tool, a well-secured certificate database, and methods of synchronization between your certificate database and your Identity Provider. A common way organizations automate certificate management is using the Intune CA Partner API, which is implemented with the SecureW2 PKI.

Certificate Policies

This enables organizations to create automated certificate policies. For example, a policy could revoke certificates when Intune says a device is not compliant or issue a certificate that is given lower levels of authorization.

Certificate policies in general should be aligned closely with existing policies in your Identity Provider or MDM. This is what makes APIs such as the Intune CA Partner API so great, because it’s just an extension of all the policies that exist in Intune.

Hardware Security Module (HSM)

A Hardware Security Module isn’t a mandatory component of PKI security, but, when implemented, it improves the security of the PKI as a whole. This device protects and manages digital keys and serves as the groundwork for building a secure enterprise PKI. The HSM contributes to managing the complete lifecycle of cryptographic keys, which includes creation, rotation, deletion, auditing, and support for APIs to integrate with various applications.

What Is PKI Used For?

A PKI can be used for multiple applications, including Wi-Fi authentication, web application authentication, email security, and VPN. How your organization designs and uses the PKI depends largely on what your security needs are, which vendor you choose, or if you decide to construct your own. We have described below how each use case is tied to PKI:

• Wi-Fi Authentication: PKI enables secure, certificate-based Wi-Fi authentication using the EAP-TLS protocol, which provides mutual authentication. It verifies both the client device and the RADIUS server via digital certificates to prevent unauthorized access and protect data transmitted over the air. This replaces weaker password-based methods with stronger identity verification by using asymmetric cryptography and a trusted CA to ensure only legitimate entities connect to the network.
• Wired Security PKI: This secures wired connections through 802.1X port-based authentication, where an 802.1X-enabled switch blocks access until the device presents a valid digital certificate verified against a trusted CA. This in turn enables mutual authentication, preventing unauthorized devices from joining the LAN, and protecting against rogue network access.
• Web Application Authentication: This is similar to Wi-Fi authentication where a user connecting to a web application will have their identity confirmed by the web application server. Since the certificate is signed by the trusted CA, users can gain access to the application.
• VPN Authentication: Since VPNs can grant access to critical information, certificates are a preferred method of authentication over passwords. Usually the root/Intermediate CA is stored on the Firewall and once the user is authenticated, a secure tunnel is created to access the network the user is trying to access.
• Email Security: Encrypting emails with certificates utilizes the S/MIME (Secure/Multipurpose Internet Mail Extensions) protocol. Both the receiver and sender are required to have a certificate signed by the CA to establish trust between the users. S/MIME provides the cryptographic security required to:
  • Guarantee the origin of the message with the digital signature from the certificate
  • Encrypt the message
  • Authenticate the recipient’s certificate to decrypt the message

Benefits of PKI in a Network Environment

Improve End-User Experience

Passwords require repeated input and frequent resets. When combined with multi-factor authentication (MFA), the user experience often becomes frustrating.

As more organizations adopt passwordless authentication methods, digital certificates with a PKI are becoming the preferred choice. The National Institute of Standards and Technology (NIST) prescribes specific frameworks to secure critical data in an enterprise network and it strongly recommends using digital certificates with a PKI for Wi-Fi and VPN authentication.

Prevent Breaches Due to Stolen Credentials

When a device attempts to connect to the network, it must prove possession of its private key, which cannot be phished or reused like a password. Even if a malicious actor intercepts the certificate or gains access to the network traffic, they cannot authenticate without the corresponding private key, which remains securely stored and inaccessible. This cryptographic identity verification ensures only authorized users and trusted devices can access network resources.

Reduce Password-Related Support Tickets

Since digital certificates replace passwords for authentication, users no longer need to remember, reset, or frequently change credentials. Automated certificate issuance and renewal also streamline onboarding and access management, reducing manual intervention and support costs.

Increase Visibility Over Network Access

Unlike passwords, which can be shared or stolen, digital certificates are device-bound and traceable. Detailed RADIUS logs show who and what connected or accessed the network when a device authenticates using a certificate.

The Risks of Poor PKI Management

A PKI can significantly strengthen cybersecurity, but poorly managed PKI certificates can introduce vulnerabilities. And since certificates are implicitly trusted after issuance, these vulnerabilities are even greater than those with password-based security.

Some of the most common risks are:

• Certificate expirations: Many certificate authorities issue certificates with an expiration date (often one year or less). If the certificate isn’t renewed before the expiration date, users or identities may be unable to access critical services, disrupting operations and frustrating users.
• Unrevoked certificates: Certificates are recognized indefinitely until they’re explicitly revoked. Lost devices and employees who leave or change roles can lead to unauthorized access, data leaks, or lateral movement by insiders or attackers.
• Compromised keys: If a private key is exposed through poor storage, exfiltration via malware, or insider theft, attackers can impersonate the legitimate owner.

Simply having a PKI infrastructure doesn’t automatically ensure improved security. The purpose of a PKI is to issue and manage digital certificates, but how the certificates are issued and managed is important, too.

Best PKI Implementation Practices for Your Network

PKI implementation needs a strategy and a far-sighted approach to build a secure network. With digital certificates, your network will be ready for secure communication through identity and context-based device trust. However, a PKI alone won’t address security needs unless properly implemented.

Follow these best practices for PKI success:

• Use an Intermediate CA for certificate issuance: The Root CA is the main anchor of trust in a PKI and should never be compromised. An Intermediate CA can be established under an organization’s central CA and then separated based on geographical locations, departments, etc., so the Root CA can remain separate and well-guarded.
• Automate certificate lifecycle management: Automating certificate management through a managed PKI streamlines certificate enrollment, issuance, renewal, revocation and ongoing maintenance.
• Perform regular audits and compliance checks: A PKI should maintain an audit trail for all certificates issued, renewed, revoked, and stored in the network. Security teams should regularly monitor these logs to respond quickly to incidents and detect unusual activities. If any unusual incident is detected, an automated alert should be set up to notify security and prevent further access.
• Integrate PKI with identity and access management (IAM) tools: By integrating PKI with IdPs and MDMs, organizations can use EAP-TLS to strengthen security and link users and devices to certificate-based authentication for identity and access management tools.
  IAM tools ensure that only trusted users and devices can access resources within a network through context-based, granular policies.
• Protect private keys using hardware security modules (HSMs): Organizations should ensure that the secure root and intermediate keys never leave the hardware security module. There should be limited access and restrictions on viewing and exporting cryptographic keys.
• Onboard software to authenticate managed and BYODs to a network: Onboarding software automates certificate issuance to managed devices using protocols such as the Dynamic Simple Certificate Enrollment Protocol (SCEP) and Automated Certificate Management Environment (ACME). It also helps BYOD and guest devices self-enroll for certificates and authenticate safely to a network with limited access, preventing unauthorized access.

On-Premises PKI vs. Managed Cloud PKI: Which Is Right for You?

On-premises PKI deployment involves the setup and configuration of all the PKI components as well as ongoing maintenance and a requirement to store it in a secure area to protect against physical breaches.

Maintaining strong security around the PKI is of utmost importance. If private keys or the Root CA are compromised, every certificate would be at risk and need to be replaced and the organization would be highly susceptible to data theft. The term for responding to such an event is disaster recovery, and restoring a local PKI can be an intensive process.

A managed cloud PKI solution, like the PKI offered by SecureW2, requires no forklift upgrades to integrate directly with existing infrastructure. Your IT team only needs to connect the PKI to the network and configure the settings and onboarding software to distribute certificates. Since the PKI is externally hosted, the responsibility of maintaining and securing the PKI falls to the vendor.

A cloud PKI also has strong scalability, so as the organization grows, the PKI can easily grow with it. The costs over the lifetime of a cloud PKI are significantly lower than the costs of a local PKI because there’s no need for on-premises installation or security.

A managed PKI provides straightforward solutions to many problems and inefficiencies faced by all organizations with unsecured wireless networks. Network admins never have to manually configure each device for certificates, and they can easily monitor network activity, investigate connection issues, and revoke certificates when they are no longer needed.

SecureW2 offers affordable managed Cloud PKI options for organizations of all shapes and sizes. Click here to see how SecureW2 could work in your environment.

Public Key Infrastructure (PKI) FAQs

Is a Digital Certificate the Same as a Private Key or Public Key?

No, a digital certificate is not the same as a private or public PKI key. However, it does contain your public key. A digital certificate, which can also be referred to as a PKI certificate, should be thought of as a digital passport, or a driver’s license. A PKI certificate contains a customizable amount of information. Common attributes encoded in a PKI certificate are email addresses, first and last names, the groups a user is associated with in the Identity Provider, the serial number of the device, an Azure Device ID, and other bits of identifiable information.

PKI keys are also on PKI certificates and are public for all to see. This is necessary, or a third party wouldn’t know how to ensure that the certificate was really yours. The private key, however, is not on your PKI certificate. While your device understands the two are linked to each other, the private cryptographic key never leaves the device, should never be seen by anything other than your computer, and is stored securely in a special part of your device, commonly a TPM or Secure Enclave.

What Are the Core Cryptographic Algorithms Behind PKI?

PKI relies on a clever combination of asymmetric (public-key) algorithms for secure key exchange, digital signatures, and certificate signing, plus symmetric algorithms for fast, efficient encryption after establishing trust.

While modern PKI increasingly favors efficient options such as elliptic curve cryptography (ECC/ECDSA), the classics, including RSA for signing and key exchange, DSA for signatures, Diffie-Hellman for secure key agreement, and AES-256 for session encryption, remain widely used or historically important.

Here are some key cryptographic algorithms you’ll encounter in PKI systems today:

• AES 256 Encryption
• Diffie-Hellman
• RSA Key Exchange
• DSA

What Is TLS Cipher Suite?

A TLS cipher suite defines the combination of key exchange, authentication, encryption, and message authentication algorithms used during a TLS session. Before TLS came to be, SSL was the go-to protocol.
Some wrappers only support certain versions of TLS, whereas the SecureW2 wrapper supports any version of TLS when onboarding a user’s device. However, like most, TLS 1.0 support has been dropped due to growing vulnerabilities.

What Is a Microsoft PKI?

Microsoft offers a commonly used PKI called Active Directory Certificate Services (AD CS). It was designed to work with Microsoft environments like Active Directory (AD), Network Policy Server (NPS), and Group Policy Objects (GPO) that historically dominated IT infrastructures.

While some still use AD CS, many organizations are moving away from it due to the limitations that come with being designed for legacy infrastructure. It requires a lot of human resources to deploy and maintain, and everything needs to be on-premises, which can prevent organizations from moving to an all-cloud environment.

Does EAP-TLS use a PKI?

The EAP-TLS authentication method does use PKI. EAP-TLS is a WPA2-Enterprise network protocol that is used for encrypted, certificate-based authentication. As a user connects or enrolls to the secure network, EAP-TLS authentication confirms the identity of the user and the server in an encrypted EAP tunnel that prevents outside users from intercepting credentials or other information sent over-the-air. They can safely transmit data through the tunnel, resulting in a fast, secure and successful authentication.

Why are Certificates essential for securing AI agents and non-human identities?

Certificates provide a hardware-bound, cryptographically verifiable identity for AI agents, services, and workloads, making them far more secure than API keys or tokens. In AI-driven environments, where autonomous agents interact with multiple systems, certificates ensure that only trusted, authenticated entities can access sensitive data or services.

Unlike static credentials, certificates support mutual authentication, short-lived identities, and automated lifecycle management, which are critical for dynamic AI systems. This makes them the standard authentication mechanism for non-human identities, enabling Zero Trust enforcement across machine-to-machine communication.

How does Certificate-Based Authentication work in AI systems using SPIRE?

In a typical AI architecture, each device or workload first presents its initial certificate to a SPIRE server. The SPIRE server then validates this identity and issues ephemeral (short-lived) certificates to AI agents and services.

These short-lived certificates are often valid for minutes or hours and are used for secure, continuous authentication between agents and services. This ensures that:

• Only authorized workloads can communicate
• Access is dynamically verified (not one-time authentication)
• Compromised identities have limited exposure due to short lifespans

This model enables scalable, Zero Trust security for AI ecosystems, where identities are constantly verified and tightly controlled.