A Public Key Infrastructure is built from seven core elements: public and private keys, public key certificates, a Certificate Authority, a Registration Authority, secure key storage, a certificate repository, and automated certificate management.
PKI requires public and private key pairs for encryption, public key certificates that prove identity, a Certificate Authority to issue and sign those certificates, a Registration Authority to verify requester identity, secure storage such as an HSM for private keys, a certificate repository for storing and distributing certificates, and automation to handle issuance, renewal, and revocation without manual effort.
Key Takeaways
- Key pairs are the cryptographic foundation everything else builds on. The public key can be freely shared; the private key must never leave the secure environment it was generated in.
- The CA and RA split trust verification from certificate issuance. The RA verifies identity and forwards the request; the CA signs and issues the certificate itself, adding a layer of separation.
- Secure key storage is where most real-world PKI failures originate. Private keys left in plaintext storage, logs, or shared drives undermine every other element of the PKI regardless of how well the rest is designed.
- The certificate repository makes revocation checking possible. Without a place to publish CRLs and root certificates, relying parties would have no way to confirm a certificate’s current status.
- Automation is what keeps a PKI operational at scale. Manual issuance, renewal, and revocation cannot keep pace once certificate counts grow, and a single unnoticed revoked certificate can disrupt an entire network.
The Seven Core Elements of a PKI
Each element plays a distinct role, and removing any one of them weakens the security guarantees the whole system provides.
- Public and private keys. PKI uses this asymmetric key pair to establish and secure encrypted connections across the network.
- Public key certificates. Issued by a Certificate Authority, these certificates prove ownership of a public key and state the authenticity of the keyholder.
- Certificate Authority (CA). A trusted entity that verifies an organization’s identity and generates a digital certificate containing that organization’s information and public key, signed with the CA’s own private key.
- Registration Authority (RA). Acts as an intermediary between users and the CA, verifying the identity of entities requesting certificates before forwarding the request, adding a layer of authentication.
- Secure key storage. Cryptographic keys, especially private keys, require tamper-resistant storage; Hardware Security Modules provide this for maintaining confidentiality and integrity.
- Certificate repository. A location, accessible through LDAP, FTP, or web servers, where certificates, public keys, validity details, revocation lists, and root certificates are stored.
- Automated PKI operations. Certificate management software handles issuing, revoking, and renewing certificates; without automation, one invalid or overlooked certificate can halt productivity or an entire network.
How the CA and RA Work Together
Separating identity verification from certificate issuance adds a layer of authentication that a single combined entity would not provide.
When an entity requests a certificate, the Registration Authority verifies the identity behind that request first. Only after this verification does the request move to the Certificate Authority, which generates and signs the certificate. This division of labor means a compromise or error at the identity-verification stage does not automatically translate into a fraudulently issued certificate from the CA itself.
Why Secure Key Storage Deserves Special Attention
A Hardware Security Module provides a tamper-resistant environment purpose-built for storing and managing cryptographic keys, which is a stronger guarantee than encrypted software storage alone. Whatever storage method is chosen, private keys should never sit in plaintext, in application logs, or in general-purpose file storage, since any of those locations gives an attacker with system access a direct path to full compromise.
Every other PKI element depends on the private key actually staying private, which makes storage the highest-stakes component to get right.
How Encryption Consulting Helps
Encryption Consulting’s PKI Advisory Services help organizations design and implement every element of a PKI, from CA and RA architecture to HSM-backed key storage, while CertSecure Manager automates day-to-day certificate operations across the resulting infrastructure. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
What is the difference between a Certificate Authority and a Registration Authority?
A Registration Authority verifies the identity of an entity requesting a certificate and forwards the validated request to the Certificate Authority. The CA then generates and signs the actual certificate. This separation adds a layer of authentication rather than combining identity verification and issuance in a single entity.
Why does PKI need a certificate repository?
The certificate repository stores certificates, public keys, validity details, revocation lists, and root certificates in a location accessible through LDAP, FTP, or web servers. Without it, relying parties would have no reliable way to retrieve certificates or check current revocation status.
What happens if PKI operations are not automated?
Manual issuance, renewal, and revocation cannot scale reliably as certificate counts grow, and even one overlooked invalid or revoked certificate can disrupt productivity or bring down network access. Automated certificate management software is what keeps a PKI’s operational elements running at scale without constant manual intervention.
Is a Hardware Security Module required for every PKI?
Not strictly required, but strongly recommended, especially for Certificate Authority private keys. An HSM provides tamper-resistant hardware storage that is significantly harder to compromise than encrypted software-based key storage, which matters most for the keys that anchor trust for an entire certificate hierarchy.
Build Every Element of Your PKI Correctly
Explore Encryption Consulting’s PKI Advisory Services to design a complete PKI architecture, from key generation through automated certificate operations.