What is PKI?

PKI (Public Key Infrastructure) is the whole system that makes certificates usable: a certificate authority, the certificates it signs, the private keys that go with them, and a way to cancel certificates before they expire.

Each participant (a server, a VPN user, a website) has a key pair. The private key stays with its owner and never leaves; the public key goes into a certificate, which the CA signs to vouch for who it belongs to. When two parties connect, each presents its certificate, checks the other's against the CA it trusts, and proves it holds the matching private key. Certificates expire on a date written into them, and a certificate revocation list (CRL) or an online check covers the ones that must stop working sooner, such as a lost laptop or a person who has left.

Small private PKIs are common in networking: VPNs, management access to devices, internal web services and RPKI all rely on one. The everyday work is mostly operational: issuing certificates for new users and servers, renewing them before they expire, revoking them promptly, and keeping the CA's private key safe. The OpenVPN on Debian lesson builds a complete small PKI with easy-rsa, and shows what goes wrong when the revocation list can't be read or expires.