We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Security Architecture
Free preview: the first 2 parts of this 7-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Architecture
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
When you visit your bank's website, your browser instantly trusts it. Your computer has never connected to that server before. It does not know the bank's administrators. It has no prior relationship. Yet within milliseconds, it establishes an encrypted connection and begins transmitting sensitive financial data.
Public Key Infrastructure makes this possible. Your browser ships with about 150 pre-installed root Certificate Authority (CA) certificates. Those CAs vouch for intermediate CAs. Intermediate CAs vouch for websites. This chain of trust is what makes work for billions of websites without every website needing to individually register with every browser.
Let's Encrypt alone has issued over 4 billion certificates since launching in 2015. They issue approximately 3 million new certificates per day. The entire web PKI ecosystem processes certificate validation for over 5.5 billion HTTPS connections daily. Without PKI, there is no HTTPS, no secure email (S/MIME), no code signing, no VPN authentication, no mTLS between .
| Component | Role | Real-world example |
|---|---|---|
| Root CA | Top of trust hierarchy. Self-signed. Embedded in browsers/OS. Kept offline in HSMs | DigiCert Global Root G2, ISRG Root X1 (Let's Encrypt) |
| Intermediate CA | Signs end-entity certificates. Online. If compromised, only it is revoked (not the root) | Let's Encrypt R3, DigiCert SHA2 Extended Validation Server CA |
| End-entity certificate | The certificate on your web server, signed by an intermediate CA | *.google.com, api.stripe.com |
| Registration Authority (RA) | Verifies identity before the CA issues a certificate | Domain validation (DV): prove you control . Extended validation (EV): prove you are a legal entity |
| CRL | Certificate Revocation List. Downloadable list of revoked certificates | Published by CAs, checked by browsers (slowly being replaced by OCSP) |
| OCSP | Online Certificate Status Protocol. Real-time revocation check | Browser asks CA "is this cert revoked?" before trusting it |
| OCSP Stapling | Server pre-fetches its own OCSP response and staples it to the TLS handshake | Eliminates the privacy concern of browsers querying CAs for every site they visit |
| Certificate Transparency | Public append-only logs of all issued certificates | Google's Pilot, Cloudflare's Nimbus. Chrome requires all certs to be logged |
Trust chain verification flow:
The browser receives the server's certificate during the TLS handshake. It checks the signature on the certificate against the intermediate CA's public key. Then it checks the intermediate's signature against the root CA's public key. The root's public key is already in the browser's trust store. If any link in the chain is expired, revoked, or has an invalid signature, the connection fails.
Private PKI for internal use. Organizations run their own CAs for mTLS between services, code signing, and device authentication. Tools like step-ca (Smallstep), cfssl (Cloudflare), EJBCA, or AWS Private CA handle internal certificate lifecycle. Istio and Linkerd include built-in CAs for mTLS. Netflix's Lemur manages their internal PKI, issuing and rotating certificates for their 700+ microservices.
It is easy and good
“It is really nice and good Please join the course”