Public key infrastructure (PKI) is the system used to create, distribute, validate, and revoke digital certificates. It combines certificate authorities, registration processes, keys, certificate revocation data, and trust rules so software can decide whether a certificate really belongs to a person, server, or organization. In practice, PKI is what lets browsers trust HTTPS sites and lets organizations use certificates for signing, authentication, and encrypted connections.
PKI matters because trust depends on it. If a certificate is misissued, stolen, or not checked correctly, attackers can impersonate websites, intercept traffic, or sign malicious code as if it were legitimate. Defenders rely on PKI to enforce identity at scale, but they must also manage certificate lifecycles, monitor revocation, and audit which systems trust which certificate authorities. Weak PKI management is a common source of operational outages and a target for man-in-the-middle and phishing attacks.