Mister PKI

SSL Certificates * SSL Tools * Certificate Decoder

Public Key Infrastructure (PKI) is the foundation that allows secure TLS communication across modern infrastructure. DevOps teams rely on PKI to issue, manage, and validate certificates used by web servers, APIs, internal services, and application platforms.

This guide explains how PKI architecture works in real-world environments and how DevOps engineers design scalable certificate infrastructure.

This article is part of the PKI for DevOps Engineers training series. In the previous lesson we covered TLS errors and troubleshooting. In this lesson we focus on how organizations design PKI systems.

—

Table of Contents

—

What is PKI architecture?

PKI architecture refers to the design of the systems responsible for issuing, managing, validating, and revoking digital certificates.

A PKI system enables trusted communication between systems using TLS encryption.

PKI makes it possible for clients to verify that a server’s identity is legitimate before establishing a secure connection.

If you want to understand how certificates work internally, see our lesson on X.509 certificates.

—

Core PKI components

A typical PKI system includes several core components.

Certificate Authorities (CAs)

Certificate authorities issue and sign certificates. They act as the trusted entities responsible for verifying identities.

Certificate repositories

Repositories store issued certificates and revocation information so that clients can validate certificate status.

Registration authorities

Registration authorities validate certificate requests before they are approved by a certificate authority.

Certificate revocation systems

Revocation systems allow certificates to be invalidated if a private key becomes compromised.

—

Root and intermediate certificate authorities

PKI systems typically use a hierarchy of certificate authorities.

The hierarchy generally includes:

  • root certificate authority
  • intermediate certificate authorities
  • end entity certificates

Root certificate authorities sit at the top of the trust hierarchy and are often kept offline to protect the root signing key.

Intermediate certificate authorities issue certificates to servers and applications.

If you want to understand how these certificates connect together, see our lesson on certificate chains.

—

Certificate issuance workflow

Certificates are typically issued through a multi-step process.

  1. generate private key
  2. create certificate signing request
  3. submit CSR to certificate authority
  4. certificate authority signs certificate
  5. certificate is installed on server

DevOps engineers frequently generate CSRs using OpenSSL.

See our guide on creating CSRs with OpenSSL for detailed examples.

—

Internal PKI vs public certificate authorities

Organizations typically use two types of PKI systems.

Public certificate authorities

Public CAs issue certificates trusted by browsers and operating systems. These are commonly used for public websites.

Internal certificate authorities

Internal PKI systems issue certificates used within private infrastructure.

Internal PKI is commonly used for:

  • microservices communication
  • internal APIs
  • service mesh authentication
  • internal TLS encryption
—

PKI in modern DevOps environments

Modern infrastructure often contains hundreds or thousands of services that require TLS encryption.

DevOps teams integrate PKI into infrastructure by:

  • automating certificate issuance
  • automating certificate renewal
  • monitoring certificate expiration
  • deploying certificates automatically

These processes connect directly with earlier lessons in this training series including:

Certificates are often packaged into formats such as PKCS12 when deployed to certain systems.

—

Validating PKI deployments

After certificates are deployed, TLS configurations should be validated to ensure the PKI system is functioning correctly.

OpenSSL tools are commonly used for this purpose.

For example:

openssl s_client -connect example.com:443

This command allows engineers to inspect the certificate chain and TLS configuration.

You can also validate certificate chains locally using openssl verify.

—

Frequently Asked Questions

What is PKI architecture?

PKI architecture refers to the design of systems responsible for issuing and managing digital certificates used in secure communication.

What is the role of a certificate authority?

A certificate authority verifies identities and issues signed certificates that allow systems to establish trusted TLS connections.

Why do organizations run internal PKI systems?

Internal PKI systems allow organizations to secure internal services and infrastructure using certificates issued by trusted internal authorities.

How do DevOps teams manage large numbers of certificates?

DevOps teams typically automate certificate issuance, monitoring, and renewal processes to manage certificates at scale.

—

Final Lesson

In the final lesson of this training series we will bring everything together and review best practices for managing certificates in DevOps environments.

Lesson 12 – PKI Best Practices for DevOps →

—

Training Series Navigation