Public key infrastructure (PKI)

PKI, or public key infrastructure, is the combination of certificate authorities, digital certificates, cryptographic key pairs, policies and software that lets people and systems trust that a given public key really belongs to a particular person, organization or device. It is the plumbing behind HTTPS padlocks, secure email and certificate-based digital signatures.

Public key cryptography gives each participant two mathematically linked keys. The private key is kept secret and is used to sign; the public key is shared and is used to verify. The weak point is identity: anyone can generate a key pair and claim to be anyone. PKI solves this by having a trusted certificate authority (CA) check an applicant's identity and then issue a digital certificate, a signed statement binding the public key to a name.

Trust flows through chains. Your software ships with a set of trusted root certificates; roots sign intermediate CA certificates, which in turn sign end-user certificates. When a PDF reader validates a digital signature, it follows that chain back to a trusted root, checks that no certificate has expired, and checks revocation lists or online status services to make sure the certificate was not withdrawn.

Here is a concrete case. A hospital group issues each department head a signing certificate from its internal CA. When a department head signs a policy document, colleagues' PDF readers, configured to trust the hospital's root, show the signer's name and confirm the file is unaltered. Outside readers that do not trust that internal root will show the signature as unverified, even though the cryptography is sound.

That example points to a common misconception: that PKI makes a signature universally trusted. Trust depends entirely on which roots the verifier accepts. Another misunderstanding is that PKI means encryption. PKI supports both encryption and signing, but a digital signature proves origin and integrity without hiding the content. And a hash such as SHA-256 is not encryption either; it is a one-way fingerprint that signatures build on.

In the EU, PKI underpins advanced and qualified electronic signatures, with qualified trust service providers acting as heavily supervised certificate authorities.

Our take: PKI is powerful but carries real operational weight, from certificate renewals to revocation checks. For many small businesses, a well-kept audit trail and a verifiable document hash, which is what eSignSimple provides alongside its certificate of completion and /verify page, deliver practical assurance without running certificates. Certificate-based signing is on our roadmap.