What does PKI stand for?
PKI stands for Public Key Infrastructure. The system of certificate authorities, certificates, keys and policies that binds public keys to identities so they can be trusted.
A PKI is everything needed to issue and manage digital certificates: certificate authorities that sign them, registration authorities that check identities, the certificates themselves, and the ways to revoke them, which are certificate revocation lists and OCSP. Its purpose is to bind a public key to an identity so that others can trust it. The root CA's private key is the foundation of that trust and is normally kept offline.
PKI in practice: an example
A web server generates a key pair and sends a certificate signing request to a CA. The CA verifies control of the domain and issues a certificate. Browsers trust it because it chains to a root they already trust. If the private key leaks, the CA revokes the certificate and clients learn that through a CRL or OCSP.
What PKI is confused with
PKI vs TLS: what is the difference?
TLS is the protocol that encrypts the connection. PKI is the system that issues the certificates TLS uses to prove the server's identity. What TLS stands for
Which exams cover PKI?
PKI is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 1.3 (General Security Concepts).
- CySA+ CS0-004: on the acronym list, not tied to one objective.
- Network+ N10-009: 4.0 (Network Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A server's private key was exposed in a backup. What should happen to its certificate?
- Nothing, it expires eventually
- It should be revoked and a new key pair issued
- It should be renamed
- It should be copied to more servers
Show the answer
B. It should be revoked and a new key pair issued. Revocation tells clients, through a CRL or OCSP, to stop trusting the certificate before its expiry date. A new key pair is needed because the old private key is known.
2. Why do organizations keep the root CA offline?
- To save electricity
- Because compromise of its private key would undermine every certificate below it
- Because root certificates cannot be copied
- To make certificates expire faster
Show the answer
B. Because compromise of its private key would undermine every certificate below it. All trust chains end at the root. Intermediate CAs do the daily signing so the root key is exposed as little as possible.
Sources: NIST glossary: public key infrastructure; NIST SP 800-32, Introduction to Public Key Technology and the Federal PKI Infrastructure. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.