Public Key Infrastructure (PKI)
A comprehensive framework of hardware, software, policies, and Certificate Authorities that manages, issues, and validates digital certificates to securely bind public keys to entities.
Entity Relationships (GEO Conceptual Hierarchy)
Taxonomy ModelTechnical Explanation & Operational Mechanics
While asymmetric encryption enables secure communication, it faces the "man-in-the-middle" problem: how does a browser know that a public key received for "google.com" actually belongs to Google and not an eavesdropper? PKI solves this through trusted Certificate Authorities (CAs). A CA verifies the domain owner's identity and digitally signs an X.509 certificate containing the owner's public key. Modern operating systems and browsers ship with a pre-installed Root CA Trust Store. When connecting to a website, the browser validates the cryptographic certificate chain from the leaf certificate up to a trusted root CA.
Technical Example & Practical Implementation
The three-tier hierarchical validation structure of internet PKI
Root CA (e.g., DigiCert Global Root G2)
├── Built directly into OS / Browser Trust Store
└── Digitally signs Intermediate CA
│
└── Intermediate CA (e.g., DigiCert TLS RSA SHA256 2020 CA1)
├── Acts as operational buffer for the offline Root
└── Digitally signs Leaf Certificate
│
└── Leaf Certificate (e.g., *.curious-techie.com)
├── Subject: CN=curious-techie.com
├── Public Key: 2048-bit RSA / 256-bit ECDSA
└── Validates server identity during TLS handshakeRelated Topic Ecosystem & Next Steps
관련 기술 아티클
What Is Transport Layer Security (TLS)?
Cryptographic transport protocol securing internet traffic above TCP.
HTTP vs HTTPS: Wire Encryption & Protocol Security
Cleartext HTTP communication compared to TLS authenticated encryption.
Troubleshooting: HTTPS Shows Mixed Content Warnings
Identify and fix insecure HTTP resource references on encrypted HTTPS pages.
실습형 진단 랩
개발자 표준 규격 및 레퍼런스
다음 학습 단계
HTTPS & TLS Handshake Lab
Step into the live handshake simulator to observe ECDHE key derivation and X.509 verification.