Certificate and PKI
PKI · public key infrastructure · X.509 certificate · SSL certificate · certificate authority · CA · ACME
A certificate is a digital identity card that binds a public key to a name (website, person, machine); PKI is the system that issues, verifies and revokes these certificates.
In practice
A certificate authority signs the certificate after checking that the applicant really controls the name in question; the browser trusts that signature because the authority is in its trust store. A certificate expires, and it can be revoked if its private key has leaked. The CA/Browser Forum is shortening their lifetime: 200 days at most since 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029, which makes automated renewal (ACME) all but essential. Companies also run internal PKIs for workstations, VPN or Wi-Fi.
Fictional case: one Friday evening, the certificate on an SME’s ordering site expires; browsers display a warning and sales stop for the whole weekend. Since then, a certificate inventory and automated renewal raise an alert thirty days before every expiry.
How to protect yourself
- Keep an inventory of certificates, with their expiry dates and owners.
- Automate issuance and renewal.
- Protect private keys and promptly revoke any certificate whose key may have leaked.
