CISSP 7.4 - Public Key Infrastructure

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series builds the public key infrastructure from Domain 3 — the trust machinery that quietly runs behind every secure connection, binding identities to public keys through vouching authorities, and the habits that keep certificates issued, verified, and retired without drama.

Frequently Asked Questions

What is the public key infrastructure and why do we need it?

Public key cryptography lets strangers communicate, but it leaves one gap: how do you know a public key really belongs to who it claims? The public key infrastructure fills that gap with a hierarchy of trust, binding identities to public keys using trusted third parties and digital certificates. That framework is what makes secure communication possible at global scale.

What lives inside a digital certificate?

A digital certificate is essentially an endorsed copy of someone’s public key that a trusted authority vouches for. Certificates follow the X.509 standard and carry a predictable set of fields: a version and serial number, the signature algorithm and issuing authority, a validity period, and the subject’s name and public key. Think of it as a notarized identity card for a key.

Who issues certificates and how is trust chained?

Certificate authorities are neutral organizations that notarize certificates after verifying identity, while registration authorities help verify identities without issuing certificates themselves. Authorities keep their root certificate on an offline system and use it to create online intermediate authorities. The chain from your certificate up through intermediates to a known root is called certificate chaining, and the browser walks it link by link.

How is a certificate revoked and its status checked?

A certificate may be pulled early because a private key leaked, it was issued in error, subject details changed, or the person left the sponsoring organization. Status can be checked three ways: a certificate revocation list is a published roster of revoked serial numbers with a download lag, the Online Certificate Status Protocol answers in real time, and certificate stapling has the web server attach a signed, timestamped status itself.

What certificate file formats will you meet in the wild?

Formats split into binary and text. The most common binary format is Distinguished Encoding Rules with der, crt, or cer extensions, and its text sibling is Privacy-Enhanced Mail using pem or crt. Windows systems favor the binary Personal Information Exchange format with pfx or p12 extensions and also use text-based P7B files, so you cannot judge a certificate by its extension alone.

Reference: This article is based on concepts discussed in CISSP 7.4 - Public Key Infrastructure.