Public Key Infrastructure (PKI) is the system of digital certificates, certificate authorities, and registration authorities that verify the authenticity of online servers. This system secures the global web.
1. Certificate Authorities (CA)
A Certificate Authority is a trusted third-party organization (like Let’s Encrypt or DigiCert) that cryptographically signs digital certificates to verify that a domain belongs to a specific owner.
2. The SSL/TLS Handshake Process
When a browser connects to a secure HTTPS website, they negotiate an encrypted session:
- Client Hello: The browser sends its supported TLS versions and cipher suites.
- Server Hello: The server sends its digital certificate containing its Public Key.
- Validation: The browser verifies the certificate against built-in root CAs.
- Key Agreement: The browser generates a temporary symmetric session key, encrypts it using the server’s public key, and sends it back.
- Secure Channel: Both parties decrypt the session key. All future communication is encrypted using this fast, temporary symmetric key.