About PKI

PKI is short for public key infrastructure, a system of digital certificates, Certificate Authorities, and other registration authorities that verify and authenticate the validity of each party involved in an online transaction. A PKI is also called a trust hierarchy.

Digital Certificates, also called Digital ID's, are the electronic counterparts to driver licenses, passports and membership cards. Digital Certificates can be used to establish encryption, authentication and confidentiality and with a little bit of additional effort even authorization.
Digital Certificates bind an identity to a pair of electronic keys (private and public key).

A Certificate Authority (CA) is a trusted third-party organization or company that issues digital certificates and signs them with their own certificate (root) to prove the origin of the certificates.The role of the CA in this process is to guarantee that the individual granted the unique certificate is, in fact, who he or she claims to be.

Also the validation of certificates is very importand part of PKI.
Everytime before using a key or certificate the validity of a certificate has to be checked . In case of stolen or outdated certificates, these certificates will be revoked. Meaning, that before you trust the authentication of a message from anybody using his certificate, you should check, if this certificate is valid.

Traditional way of certificate validation (CRL)

Validation with Online Certificate Status Protocoll (OCSP)

OCSP related specifications and details