Public key infrastructure (PKI)
Public key infrastructure (PKI) is the set of roles, policies and technology used to issue, manage and check digital certificates, which bind a public key to a person, a company or a website.
Updated November 5, 2026 · 1 min read
On this page
The pieces
- Key pair: a private key the owner keeps secret and a public key anyone can see. What the private key signs, the public key can verify.
- Certificate: a file, usually in the X.509 format, stating that a public key belongs to a name, signed by its issuer.
- Certificate authority (CA): the trusted issuer that checks identity and signs certificates. Browsers and PDF readers ship with lists of CAs they trust.
- Revocation: lists and online checks showing a certificate was withdrawn before it expired, for example after a key was stolen.
Why it matters
PKI is what lets a stranger trust a key. The padlock in your browser is PKI at work: the site presents a certificate, your browser follows the chain back to a CA it trusts, and the connection is encrypted. A digital signature on a PDF uses the same chain to show who signed and that the file hasn't changed, and EU qualified electronic signatures add stricter rules on top.
In SignMaster
SignMaster's pages, signing links and API are served over HTTPS, which runs on PKI. Signatures themselves aren't certificate-based: SignMaster backs them with an audit trail and a SHA-256 document hash of each file instead.
Sources
- NIST FIPS 186-5, Digital Signature Standard (2023) · csrc.nist.gov