Who is a PKI relevant for?
A PKI is relevant for companies and organizations that want to reliably secure digital identities and automate certificate-based processes. Typical use cases include authenticating users, devices, servers, and applications, securing network access, encrypted communication, digital signatures, and IoT and machine-to-machine communication. A PKI is particularly relevant in larger or heterogeneous IT environments, as well as […]
What is a Registration Authority (RA)?
A Registration Authority (RA) performs tasks that take place before the actual certificate issuance. For example, it verifies identities and request data, implements approval processes, and forwards approved certificate requests to the responsible Certification Authority. This makes it possible to organizationally separate verification and certificate issuance.
When is a Root CA operated offline?
An Offline Root CA is used when particularly high requirements apply to protecting the central trust anchor of a PKI. Its private key remains disconnected from the network during normal operations. The Root CA is activated only for a limited number of controlled operations, such as issuing or renewing Sub-CA certificates or making structural changes […]
What is a Sub CA?
A Sub CA is a Certification Authority whose certificate has been signed by a higher-level CA. Depending on the PKI structure, it can issue certificates for additional subordinate CAs or end-entity certificates for users, devices, servers, and applications.
What is a Root CA?
The Root CA is the highest trust authority in a hierarchical PKI. Its certificate is self-signed and serves as the trust anchor for the Certification Authorities below it. Because the Root CA’s private key requires a particularly high level of protection, the Root CA is often operated offline in environments with high security requirements and […]
What are the components of a PKI?
The central components of a PKI include Certification Authorities (CAs), Registration Authorities (RAs) where applicable, digital certificates, revocation information, as well as policies and processes for issuing, managing, renewing, and revoking certificates. The CA structure often consists of a Root CA and one or more subordinate CAs.
What is a digital signature?
A digital signature is created using a private key and can be verified using the corresponding public key. This makes it possible to determine whether the signed data has been modified since it was signed and whether the signature was created using the corresponding private key.
What does a digital certificate confirm?
A digital certificate confirms the association of a public key with a specific identity or entity. Depending on the certificate, this may be a person, device, server, application, or organization.
What is an X.509 certificate?
An X.509 certificate is a standardized digital certificate that associates a public key with an identity. Among other things, it contains information about the certificate holder, the public key, the issuing Certification Authority, the validity period, and the intended purposes of the certificate.
What role do certificates play in a PKI?
Digital certificates are a central component of a PKI. They associate a public key with a specific identity, such as a person, server, application, or device. The Certification Authority confirms this association using its digital signature.