Public key infrastructure (PKI)
In cryptography, a public key infrastructure (PKI) is the system of certificate authorities, certificates and revocation that binds a public key to an identity and lets parties trust that binding. It underpins TLS, mutual TLS, digital signatures and DNSSEC, so five other entries point at a concept that has to exist here.
How it works
Public-key cryptography lets anyone encrypt to a public key or verify a signature made with the matching private key, but only if they can trust that the public key really belongs to who it claims. PKI provides that trust. A certificate authority issues a certificate that binds a public key to an identity and signs it; anyone who trusts the authority trusts the binding. Certificates chain up to a small set of trusted roots, have a validity period, and can be revoked before they expire through certificate revocation lists or an online status protocol. This machinery is what makes TLS authentication, mutual TLS and digital signatures meaningful rather than merely mathematical.
What goes wrong
A PKI concentrates trust, so its weaknesses are high-consequence. If a certificate authority can be made to issue a certificate for an identity it should not, every relying party is fooled. Internally, the enterprise certificate service is a favourite target on our engagements: a misconfigured certificate template can let a low-privileged user request a certificate that authenticates as a privileged account, a class of weakness known as AD CS abuse, which turns the trust infrastructure itself into an escalation path. Weak revocation is the quieter failure: a compromised key stays trusted because revocation is not checked, so the theoretical safety net is not there when it is needed.
Where this shows up in an audit
We review the certificate services as infrastructure and as an attack surface: how authorities and templates are configured, who can request what, whether revocation is enforced, and whether certificate-based authentication can be abused to escalate. On internal tests the enterprise certificate service is enumerated for the misconfigurations that allow privileged certificate issuance, with the escalation demonstrated. We also check where clients pin certificates (certificate pinning) and whether that pinning is correct. This is part of how we review certificate services and their abuse.