PKI
The CAs, certificates, policies and revocation machinery that bind names to public keys so others can trust them.
A PKI issues X.509 certificates (RFC 5280) that bind an identity to a public key, signed by a certificate authority. Verifiers build a chain from the leaf through intermediates to a root in their trust store. The WebPKI is governed by the CA/Browser Forum baseline requirements and browser root programmes; internal PKIs back mTLS, VPNs, device identity and code signing.
Lifetimes are shrinking: the CA/Browser Forum has voted to cut maximum public TLS certificate validity in stages to 47 days by 2029. Short lifetimes make revocation less critical but make automation (ACME) mandatory.
Where it goes wrong: root keys held outside HSMs, internal CAs with no name constraints, expired certificates causing outages, hostname verification switched off in clients, and pinning that blocks rotation. Design questions usually cover hierarchy (offline root, online issuing CAs), automation and revocation.