Public Key Infrastructures

PKI
Solution

Public Key Infrastructures (PKIs) are used today in a variety of industries to secure the electronic transfer of information enabling the identification of people and devices and provide means for trusted signatures. The secure and reliable generation, issuance, renewal, and revocation of certificates is crucial for that.

Your Key to
PKI Excellence

General overview of the components and typical architecture elements found in a PKI deployment:

The central component of a PKI is the CA. The CA is responsible for issuing, managing, and revoking digital certificates. It signs the certificates it issues with its private key to establish trust.

An optional component that assists the CA in verifying the identities of certificate requesters before certificates are issued. The RA plays a role in the enrollment process and may perform identity verification checks.

This server maintains a list of revoked certificates. Clients can check the CRL to ensure that certificates are still valid and have not been compromised.

An alternative to CRLs, the OCSP responder provides real-time certificate status information. It responds to queries from clients to determine whether a certificate is still valid.

Entities (users, devices, servers) generate their key pairs, comprising a public key and a private key. Private keys should be securely stored, often in hardware security modules (HSMs), to prevent unauthorized access.

At the top of the hierarchy is the root CA, which is self-signed and considered the trust anchor. Its public key is distributed to clients, forming the basis of trust for the entire PKI.

To enhance security and scalability, intermediate CAs can be used between the root CA and end-entity certificates. They issue certificates for specific purposes or within specific organizational units.

This is where certificates are stored on client devices and servers. It contains trusted root and intermediate CA certificates to validate the authenticity of other certificates.

This involves processes such as certificate issuance, renewal, revocation, and expiration tracking. Automation and proper management tools are essential for handling these tasks efficiently.

The process by which entities request and receive certificates from the CA. This often involves generating a certificate signing request (CSR) containing the entity's public key and identity information.

These are the public keys of trusted root CAs that clients use to verify the authenticity of certificates issued by those CAs.

Lightweight Directory Access Protocol (LDAP) directories may be used to store certificate and user information. This aids in the management and lookup of certificates.

Firewalls, intrusion detection systems, and other security measures protect the PKI infrastructure from external threats.

To ensure continuous availability, PKI components can be deployed redundantly with load balancing mechanisms.

Plans and mechanisms to restore PKI functionality in case of system failures or breaches.

Cloud-based PKI solutions are becoming more popular for their flexibility and scalability. Organizations need to consider their security requirements, scalability, and integration needs when designing their PKI deployment architecture.

Your Key to
PKI Excellence

Get Started