Public Key Infrastructure (PKI)
debt(d3/e3/b3/t7)
Closest to 'default linter catches' (d3), tools like ssllabs and openssl s_client easily detect missing intermediate certs, self-signed certs, or expiry issues; CURLOPT_SSL_VERIFYPEER=false is also flagged by most security linters.
Closest to 'simple parameterised fix' (e3), per quick_fix: install the intermediate cert in the chain, or flip CURLOPT_SSL_VERIFYPEER back to true, or set up certbot renewal cron — small targeted config changes, not refactors.
Closest to 'localised tax' (b3), PKI applies to web/api edge (TLS termination, outbound HTTPS calls) — a persistent operational concern (renewals, chain hygiene) but contained to the ingress/egress layer, not shaping the whole codebase.
Closest to 'serious trap' (t7), the misconception is exactly that 'a valid certificate means the site is safe' — devs and users routinely conflate cert validity with trustworthiness; also disabling VERIFYPEER 'just to make it work' is a notorious wrong-default that contradicts the security intent.
Also Known As
TL;DR
Explanation
PKI solves the problem: how do you trust a public key from a stranger? Certificate Authorities (CAs) sign certificates that bind a public key to an identity. Browsers and OS trust a set of root CAs. The chain of trust: root CA signs intermediate CA, intermediate CA signs domain certificate. Certificate Transparency logs record all issued certificates publicly, enabling detection of fraudulent issuance. ACME protocol (Let's Encrypt) automates certificate issuance.
Common Misconception
Why It Matters
Common Mistakes
- Setting CURLOPT_SSL_VERIFYPEER to false — disables certificate validation entirely, making HTTPS equivalent to HTTP.
- Not auto-renewing Let's Encrypt certificates — they expire every 90 days; set up certbot --renew cron job.
- Using self-signed certificates in production — browsers reject them; users click through warnings, training bad habits.
- Not monitoring certificate expiry — an expired certificate causes complete outage; use monitoring or auto-renewal.
Code Examples
// Disabling certificate verification — completely negates HTTPS:
$ch = curl_init('https://api.example.com');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // NEVER in production
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // Disables hostname check too// Correct SSL verification (default, but be explicit):
$ch = curl_init('https://api.example.com');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); // Verify cert chain
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); // Verify hostname
curl_setopt($ch, CURLOPT_CAINFO, '/etc/ssl/certs/ca-certificates.crt');
// Auto-renew Let's Encrypt cert (cron):
# 0 0,12 * * * certbot renew --quiet