What PKI Solves

Public Key Infrastructure (PKI) answers a single question: how do I trust a public key?

Without PKI, every site would just hand you "here's my pubkey" and you'd have no way to know if a man-in-the-middle swapped it.

PKI's solution: a hierarchy of trust.

• A handful of root CAs (Certificate Authorities) are trusted by your operating system / browser — pre-installed root certificate store.
• Roots sign intermediate CAs.
• Intermediates sign end-entity certificates (the cert your bank presents).
• When connecting to bank.com, you receive a chain [bank.com cert, intermediate cert, ...]. You verify each link's signature, walking up to a root in your trust store.

Root CA (trust anchor, hardcoded in OS)
   |
   v
Intermediate CA  (long-lived, signs end-entity certs)
   |
   v
end-entity cert  (90-day Let's Encrypt; 1-year EV cert; etc.)

Why intermediates?

• Roots are the keys-to-the-kingdom. Roots sit offline in HSMs. Compromise = catastrophic.
• Intermediates are operationally hot — issue thousands of certs/day. Compromise → revoke + re-issue downstream certs (painful but recoverable).

Real CAs:

• Let's Encrypt (free, automated, dominant since 2016).
• DigiCert, Sectigo, GlobalSign (commercial).
• Government CAs (DOD, eBlatform CAs).
• Internal corporate CAs (issue to internal employees/devices).

Browsers/OS root stores curated by Mozilla, Apple, Microsoft, Google, Linux distributions. Removing a root is a major event — happened to DigiNotar (2011, breached) and Symantec (2018, mis-issued certs).