What is Public key Infrastructure(PKI)?

Wiki Page Definition

    A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. The purpose of a PKI is to facilitate the secure electronic transfer of information for a range of network activities such as e-commerce, internet banking and confidential email. It is required for activities where simple passwords are an inadequate authentication method and more rigorous proof is required to confirm the identity of the parties involved in the communication and to validate the information being transferred.

Ref: https://en.wikipedia.org/wiki/Public_key_infrastructure

Major Keywords Definitions

Certificate Authorities

Certificate Authority also acronym as "CA" is trusted third party which authorize the identities of websites, web server, Individual Software and other entities. They Issue Digital Certificate which embed identity of entity with public key.

Major Functionality of CA are as follow:

1.  Issuing certificates
   
2. Maintain and issue Certificate Revocation Lists (CRLs)
   
3. Publish its certificates and CRls
   
4. Maintain status information of certificate expiration dates

 Registration Authority

Registration Authority also acronym as "RA" is a integral part of PKI. Major Role of RA is to verifies the request for Digital Certificates by confirming the identity of servers that paces the request. In Another words, If Company "BITDEPLOY" request for digital certificates, then RA will confirm the identities of owner by checking various identity like passport, company registrations, etc. After Successfully verifying RA will forward request to CA to issue digital Certificate. Which implies there many be multiple RA's for single CA,where each RAs have name and there respective public key through which CA can verify the authenticity of RA.

Certificate Repositories

Certificate Repositories is platform to store and distribute certificates. All successfully issued certificates are accessible and retried by application easily from repository. Technology like Lightweight Directory Access Protocol (LDAP) is used to store certificates. This Directory system support a large number of certificate and store them which respective public key. The Positive point of these directories is that, they can be used in highly distributed network and is accessible publicly. Apart from just storing certificates there responsibility is to update status of each certificate.

 Digital Certificates

Digital Certificate is an electronic document which provides authenticity of an entity. Which is linked with its public key.Digital Certificate are always generated in standard format.Consider Normal User going on Amazon and buying some shoes. but question is how does user knows that he/she is on right place to buy shoes and give away the credit card info. Answer is Digital Certificate is what use for authenticity of service.  

Digital Certificate

How does Digital Certificate granted and works while accessing Services ?

https://www.docusign.ca/how-it-works/electronic-signature/digital-signature/digital-signature-faq

Digital Certificates in a Public Key Infrastructure work in the following way:

1. The server of the company ("BITDEPLOY") requests for a digital certificate from a certificate authority.
2. The certificate authority verifies the identity of the company and generates a digital certificate. It hashes the contents of the certificate and signs (encrypts) the hash value using its private key. It includes this signature in the certificate and issues the certificate to the company
3. User tries to connect BITDEPLOY entering https://www.bitdeploy.in. While browser tries to connect website.
4. Digital Certificate send to web server of BITDEPLOY to the browser.
5. When browser receive certificate from web server it perform following steps:
1. Check for certificate authenticity by checking CA trustability.
2. With the public key of the CA, the browser decrypts the signature in the company’s certificate and obtains a hash
3. New hash of content in the certificate
4. If both certificates hash matched then signature in certificate is verified  to be signed by the trusted CA and the public key in the certificate is valid.
5.  Now the name in the certificate is checked against the web site’s name. If it matches then a secure connection is established for the online transactions
6. The browser also checks whether the certificate is within its expiry period.
   

   

Credit:

Charvik Patel