How does a PKI work, step by step?

A PKI operates through a defined sequence of steps that connects an identity to a public key and then allows other parties to rely on that connection with confidence.

The typical flow:

1. Key generation: An identity generates a public and private key pair.

2. Certificate request: The public key, along with identity information, is submitted to a registration authority.

3. Verification: The registration authority confirms the requester's identity according to the applicable certificate policy.

4. Issuance: The Certificate Authority signs and issues a digital certificate binding the public key to the verified identity.

5. Validation: Relying parties check the certificate against the CA's trusted root and confirm it has not been revoked.

6. Use: The verified public key is used to encrypt data, authenticate the identity, or confirm a digital signature.

Every certificate-secured interaction, from loading a website over HTTPS to authenticating a device on a corporate network, follows some variation of this same underlying sequence.