Public Key Infrastructure (PKI)

Also Known As

TL;DR

Explanation

PKI solves the problem: how do you trust a public key from a stranger? Certificate Authorities (CAs) sign certificates that bind a public key to an identity. Browsers and OS trust a set of root CAs. The chain of trust: root CA signs intermediate CA, intermediate CA signs domain certificate. Certificate Transparency logs record all issued certificates publicly, enabling detection of fraudulent issuance. ACME protocol (Let's Encrypt) automates certificate issuance.

Common Misconception

Why It Matters

Common Mistakes

• Setting CURLOPT_SSL_VERIFYPEER to false — disables certificate validation entirely, making HTTPS equivalent to HTTP.
• Not auto-renewing Let's Encrypt certificates — they expire every 90 days; set up certbot --renew cron job.
• Using self-signed certificates in production — browsers reject them; users click through warnings, training bad habits.
• Not monitoring certificate expiry — an expired certificate causes complete outage; use monitoring or auto-renewal.

Code Examples

// Disabling certificate verification — completely negates HTTPS:
$ch = curl_init('https://api.example.com');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // NEVER in production
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // Disables hostname check too

// Correct SSL verification (default, but be explicit):
$ch = curl_init('https://api.example.com');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);  // Verify cert chain
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);     // Verify hostname
curl_setopt($ch, CURLOPT_CAINFO, '/etc/ssl/certs/ca-certificates.crt');

// Auto-renew Let's Encrypt cert (cron):
# 0 0,12 * * * certbot renew --quiet

References

• ↗ https://letsencrypt.org/how-it-works/
• ↗ https://developer.mozilla.org/en-US/docs/Web/Security/Certificate_Transparency

Tags

Related Terms