PKI
acronymcryptographysecuritynetworking
Stands for: Public Key Infrastructure
The system of certificates and authorities that lets strangers trust each other's public keys.
Public Key Infrastructure answers "is this key really theirs" by having trusted Certificate Authorities vouch for keys with signed certificates. It is the chain of trust behind the padlock in your browser, and the machinery that makes TLS usable at internet scale.
Public key infrastructure is the answer to a question cryptography alone cannot settle: you can prove a key holder controls a key, but not that the key belongs to the organization named on it. PKI supplies that binding through certificates issued by authorities whose own keys are already trusted, so trust becomes transitive rather than personal.
The trust store is where this gets uncomfortable. Your browser and operating system ship with a list of root authorities you did not choose, any of which can issue a certificate for any name. That is a large amount of delegated trust, and the history of PKI includes authorities that were compromised, careless, or coerced. Certificate transparency logs exist because detection turned out to be more achievable than prevention.
Private PKI inverts the trade. Running your own authority for internal services means no external party can issue for your names and no public log records their existence, at the cost of distributing your root to every client that must trust it. The choice between public and private is really a choice about who you would rather depend on, and neither answer is free.
Also known as: pki, public key infrastructure, certificate authority, CA