Free tools Windows power users keep installed
One-click scans. No signup required.
Public key infrastructure (PKI) is the set of people, policies, processes, and technology used to create and manage public-key certificates. That covers issuing, maintaining, validating, and revoking them. NIST’s glossary notes that these certificates support encryption, digital signatures, and authentication. PKI is not a single product or algorithm. It is the framework that lets one system decide whether a public key really belongs to the server, person, or device that claims it.
The core idea: binding an identity to a public key
Public-key cryptography uses a pair of mathematically linked keys. The owner keeps the private key secret, and the public key can be shared freely. This creates a problem: if someone hands you a public key and says it belongs to a particular bank, how do you know?
As an Amazon Associate I earn from qualifying purchases.
PKI answers this with a certificate. NIST’s glossary describes a public key certificate as a data structure that ties a public key to its owner. It contains the public key and identifying information, and a certificate authority (CA) digitally signs it. RFC 5280, the IETF’s internet certificate profile, puts the principle this way: “The binding is asserted by having a trusted CA digitally sign each certificate.”
The parts of a PKI
Key pair
A private key held by the owner or system, and the matching public key that can be distributed. Keeping the private key safe is the owner’s job. A certificate does nothing to protect it.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Digital certificate
A signed record linking a public key to a named subject. Relying systems check the CA’s signature on it. They also check that it is within its validity period and that it is permitted for the use at hand.
Certificate authority (CA)
NIST defines the CA as the trusted entity that issues and revokes certificates. Its signature is what makes the binding believable.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Trust anchors
A valid signature does not by itself create trust. The client must already have a reason to trust the signing CA, directly or through a chain of certificates. For public CAs, NIST ties this trust to root certificates that browsers or other application developers include in their products. An enterprise or private PKI can instead limit trust to its own organization’s domain.
Recommended Free Tools
Policies and people
The “infrastructure” part includes rules for who may obtain a certificate, how identity is checked, and who runs issuance, renewal, and revocation. This is why NIST’s definition lists policies and people alongside software and platforms.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How a digital certificate works, step by step
- A system generates a key pair and keeps the private key.
- It requests a certificate from a CA, supplying its public key and identifying information.
- The CA applies its issuance policy and, if satisfied, signs the certificate.
- When another party connects or receives something signed, it is shown the certificate.
- The relying party verifies the CA’s signature and builds a trust path back to a CA it already trusts.
- It checks that the certificate is within its validity period, suitable for the intended use, and not revoked.
Only if all of this succeeds does the relying party accept the public key as belonging to the named subject.
The certificate lifecycle
Certificates do not last forever. RFC 5280 states: “A certificate has a limited valid lifetime, which is indicated in its signed contents.” Issuance, maintenance, status checking, and revocation are operational parts of PKI. A certificate may need to be revoked before it expires, for example if its private key is compromised. Neglecting renewal or revocation is a common cause of PKI failures.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What PKI is used for
Depending on the certificate and the application, PKI can support:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Authentication of servers, users, or devices.
- Digital signatures, which let a recipient verify who signed data and that it was not altered.
- Encryption, where certificates help parties obtain the correct public key.
How PKI differs from encryption
Encryption is a technique for protecting data. PKI is the system that establishes whose public keys to trust when using it. A certificate alone does not encrypt traffic. Protocols and applications do that, using keys that PKI helps authenticate. Without some form of key validation, encryption can still be performed, but you may be encrypting to an impostor.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Public versus private PKI
| Question | Public PKI | Private (enterprise) PKI |
|---|---|---|
| Who operates the CA? | A third-party CA | The organization or its contracted provider |
| Who trusts it? | Clients whose browsers or applications include its root certificates, per NIST’s definition | Only systems configured to trust the organization’s root |
| Typical scope | Publicly reachable services | Internal systems, users, and devices |
| Who handles issuance, renewal, monitoring, and revocation? | Shared between CA and certificate holder, depending on policy | The organization |
Limits worth knowing
- A certificate expresses a signed binding. It does not prove a person’s real-world identity in every circumstance. The strength of that proof depends on the CA’s policy and checks.
- A valid signature is separate from trust in the signer.
- Certificates do not make private-key handling safe.
- Relying applications must still validate the chain, validity period, and permitted use.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
