Public Key Infrastructure (PKI) is the combined framework of hardware, software, policies, and procedures used to create, distribute, store, and revoke digital certificates and to manage public-key encryption. It lets two parties who have never met establish a trusted, encrypted connection, because both sides trust the Certificate Authority that issued and vouched for their certificates.
Every HTTPS connection relies on it. Your browser ships with a set of trusted root Certificate Authorities, and when a website presents a certificate signed by one of them, the browser accepts it as proof of identity and negotiates encryption. The part that quietly breaks systems is revocation. When a private key is compromised, its certificate must be revoked and that status distributed through a Certificate Revocation List or OCSP. If clients skip the check or the responder is unreachable, a revoked certificate can keep working, which defeats the purpose.
How is PKI tested on the CISSP?
PKI is a major topic in Domain 3: Security Architecture and Engineering. Candidates must understand the certificate lifecycle, CA hierarchies and trust, revocation through CRL and OCSP, and how PKI supports encryption and identity across an enterprise.