Public key infrastructure (PKI) explained in 4 minutes

The public key infrastructure (PKI) security method has seen a major upswing in popularity and is used for everything from enabling internet of things (IoT) communication security to enabling digital document signing. Martin Furuhed, PKI expert at identity and security company Nexus Group, explains the method in 4 minutes.

What is PKI used for?

“PKI enables trusted electronic identities for people, services and things, which make it possible to implement strong authentication, data encryption and digital signatures. “These security mechanisms are used to grant secure access to physical and digital resources; secure communication between people, services and things; and enable digital signing of documents and transactions,” says Furuhed, product manager of Nexus’s certificate authority (CA) software Certificate Manager.

What makes up a PKI?

“A typical PKI consists of policies, standards, hardware and software that manage the creation, distribution, revocation and administration of digital certificates. The heart of a PKI is a certificate authority, which is a trusted entity that ensures the trustworthiness of the digital certificates,” says Furuhed.

Evaluating platforms for your PKI? Read our comparison guide of Nexus Smart ID Certificate Manager vs Microsoft Active Directory Certificate Services!


What is a digital certificate?

“A digital certificate is a file containing a range of information, such as identifying information, a serial number and expiration dates. It also includes the digital signature of the certificate authority that has issued the certificate, which is what gives validity to the certificate, as well as the certificate holder’s public key. “This is the purpose of PKI: to reliably tie a public key to a person, service or thing. Nearly all digital certificates used within PKI are based on the X.509 standard, and support for these certificates are built into a lot of software, such as email clients and servers, web servers, and operating systems,” says Furuhed.

What are public and private keys?

“In cryptography, a key is a piece of information that determines the functional output of a cryptographic algorithm. Public and private keys are generated in pairs that are mathematically linked, and they are used in asymmetric cryptography, also known as public key cryptography. “The public key is accessible to everyone and the private key is only known to the key holder. When a public key is used to encrypt data, the only way to decrypt the data is to use the linked private key. When a private key is used to sign a message, the linked public key is used to verify the signature. The use of two different keys is what gives asymmetric cryptography its name. In symmetric cryptography, the same key is used for both encryption and decryption,” says Furuhed.

What makes up an electronic identity?

“A digital certificate, which is publicly available and includes a public key, and a private key. In combination, this functions like a digital passport: it can be used to affirm the identity of a person, service or thing,” says Furuhed.

How does PKI facilitate authentication?

“When, for example, a user tries to authenticate their identity to a server, the server generates random data and sends it to the user. The user encrypts the data with their private key and sends it back to the server. The server decrypts the data with the public key in the user’s digital certificate, and if the decrypted data is the same as the sent data, the server knows that the user is who they claim to be,” says Furuhed.

How does PKI facilitate digital signing?

“The first step is to calculate a so-called hash value of the document or transaction that is to be signed. The hash value is computed with an algorithm and the result is what can be described as a digital fingerprint of the file’s contents. The hash value is then encrypted with the signing user’s private key, and the encrypted hash value is added to the document or transaction – this is the signature. “The user’s digital certificate, which includes the user’s public key, is also added to the document or transaction. Anyone can then decrypt the signature using the public key and calculate the hash value of the document. If the two results are identical, the validity of the signature and the integrity of the document is confirmed,” says Furuhed.

How does PKI facilitate encryption and decryption of data?

“When large amounts of data are to be encrypted and decrypted, symmetric cryptography has to be used, since asymmetric cryptography is too slow. Since the same key is used for both encryption and decryption in symmetric cryptography, the key first has to be shared between the two communicating parties. One of the parties generates the key and sends it to the other party using asymmetric cryptography, which is enabled by the PKI,” says Furuhed.


Download Guide: Zero Trust Checklist

Use this checklist to make sure you cover the most important aspects in order to achieve a successful security solution for your organization.


Discover the Smart ID platform

Nexus Smart ID is an identity and security platform that consists of standardized and easy-to-use modules.


Issue and manage trusted identities for people, devices and services, forming the basis of information security in your organization with the Smart ID Corporate PKI.

Learn More



 Automate enterprise certificate provisioning for endpoints, such as machines and servers, dev ops servers, mobile devices and networking devices using Nexus' Smart ID Workplace IoT PKI.
Learn More


PKI for IoT devices and applications enables end-to-end security via certificate-based, cryptographically secure and unforgeable identities.

Learn More

Identities as a Service

Explore a selection of online services enabling organizations to quickly get started with trusted identities. These services are available to trial and buy online at any time.

Learn More