📖 What is Public Key Infrastructure (PKI)?
Public Key Infrastructure (PKI) is a framework of roles, policies, hardware, and software used to create, manage, distribute, use, store, and revoke digital certificates. It enables the secure exchange of information by linking public keys with identities through a trusted Certificate Authority.
"Understand the chain of trust. If the Root CA is compromised, the entire PKI hierarchy is invalidated, which is why Root CAs are typically kept offline."
📚 Certification: CompTIA Advanced Security Practitioner+ (CAS-004)
🔑 What are the Key Concepts of Public Key Infrastructure (PKI)?
- ▸ The Certificate Authority (CA) acts as the trusted third party that validates identities and digitally signs certificates to ensure authenticity and integrity.
- ▸ Registration Authorities (RA) handle the initial identity verification process, offloading the administrative burden from the CA before certificates are officially issued.
- ▸ The Chain of Trust establishes a hierarchy where a Root CA signs Intermediate CAs, which then sign end-entity certificates to minimize Root exposure.
- ▸ Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP) provide critical mechanisms to invalidate certificates before their scheduled expiration date.
- ▸ Asymmetric cryptography provides the foundation, using public keys for encryption and verification while private keys are used for decryption and digital signing.
🎯 How does Public Key Infrastructure (PKI) appear on the CAS-004 Exam?
You may be asked to determine the most efficient method for checking certificate validity in a high-traffic environment, requiring a choice between CRLs and the real-time responses of OCSP.
A scenario might describe a security breach where a subordinate CA is compromised; you must identify the correct procedure to revoke the intermediate certificate without impacting the Root CA.
Expect questions about designing a secure PKI architecture, specifically why the Root CA should remain offline and how Intermediate CAs facilitate daily certificate issuance.
❓ Frequently Asked Questions
Why is it critical to keep the Root CA offline?
If the Root CA's private key is compromised, every certificate in the entire hierarchy becomes untrusted. Keeping it offline prevents network-based attacks and ensures it is only used to sign Intermediate CAs.
What is the main advantage of OCSP over CRLs?
CRLs require downloading a potentially large list of revoked certificates, causing latency. OCSP allows a client to query the status of a single certificate in real-time, reducing bandwidth and improving speed.
How does a Registration Authority (RA) differ from a Certificate Authority (CA)?
An RA only verifies the identity of the requester and validates the supporting documentation. It cannot sign or issue certificates; it simply tells the CA that the requester is who they claim to be.