PKI and Certificate Management Basics

By Kokil Thapa | Last reviewed: September 2026

PKI and certificate management basics decide whether browsers trust your site or show a scary warning. Public Key Infrastructure is the system of certificate authorities, keys, and policies that bind identities to cryptographic keys. On production Linux servers running Laravel, WordPress, or API gateways, a missed renewal or broken chain breaks checkout flows and client portals overnight. This guide walks through how PKI works in practice and how to manage certificates so they do not become a Friday-night emergency. If you deploy sites regularly, pair this with our SSL/TLS certificates explained article for the transport-layer side.

What is PKI and how does public key infrastructure work?

PKI is a framework for creating, distributing, and validating digital certificates. Each certificate binds a public key to an identity such as a hostname, organisation, or service account. Browsers and API clients trust that binding only when the certificate chains to a root CA they already trust.

The core actors are straightforward. A Certificate Authority signs certificates. A Registration Authority validates identity before issuance. You hold the private key on the server or in a secrets store. Relying parties—browsers, mobile apps, webhooks—verify the chain during the TLS handshake.

Key pairs and X.509 fields that matter

Every TLS certificate is an X.509 document. You care about these fields during audits and renewals:

• Subject Common Name (CN) or SAN — hostnames the cert covers; modern browsers require Subject Alternative Names.
• Issuer — which CA signed the cert; mismatches here cause chain errors.
• Validity window — notBefore and notAfter dates; Let's Encrypt certs are typically 90 days.
• Key usage extensions — digitalSignature, keyEncipherment, or extended key usage for serverAuth.
• Serial number — needed for OCSP revocation lookups.

Inspect any cert on a live server with OpenSSL:

openssl x509 -in /etc/ssl/certs/example.com.crt -noout -text | grep -E "Subject:|Issuer:|DNS:|Not "
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -dates -issuer -subject

The private key never leaves secure storage unless you are migrating. On Ubuntu servers I maintain, keys live under /etc/ssl/private/ with mode 600 and root ownership. Application containers should mount them read-only. For deeper server hardening, see our install SSL certificates on Ubuntu walkthrough.

How do you manage SSL/TLS certificates in production?

Certificate management is operational work, not a one-time setup task. You need an inventory, renewal automation, monitoring, and a documented rotation procedure. Small teams in Nepal often run five to twenty domains on one EC2 box; one expired cert on a sister site can take down lead forms for a law portal.

I treat certificate management like database backups. If it is not scheduled and monitored, it will fail silently until a user complains.

Build a certificate inventory first

Before automating anything, list every certificate in your environment. Spreadsheet columns I use:

1. Hostname or service name
2. Environment (production, staging, internal)
3. Issuer (Let's Encrypt, DigiCert, internal CA)
4. Expiry date and auto-renew flag
5. Where the cert is installed (Apache vhost, Nginx, load balancer, CDN)
6. Contact owner and runbook link

Query expiry from the command line across a fleet:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate -issuer -subject

For internal APIs, add the same check to your CI pipeline or cron. Our Linux system administration service includes expiry monitoring on shared hosting stacks because manual tracking does not scale past a dozen certs.

Automate renewal with ACME

Let's Encrypt uses the ACME protocol defined in RFC 8555. Certbot on Ubuntu remains the default for Apache and Nginx vhosts I deploy. A typical renewal hook reloads the web server after a successful issue:

sudo certbot renew --dry-run
sudo certbot renew --deploy-hook "systemctl reload apache2"

Certbot installs a systemd timer or cron job. Verify it exists:

systemctl list-timers | grep certbot
sudo certbot certificates

Cloudflare or AWS Certificate Manager can terminate TLS at the edge. You still own expiry tracking. A cert on the origin can expire even when the CDN cert looks fine. Document both layers in your inventory.

What is the difference between public and private certificate authorities?

Public CAs like Let's Encrypt, DigiCert, and Sectigo issue certs that browsers trust globally. Private CAs—often Microsoft AD CS, HashiCorp Vault PKI, or OpenSSL-based internal roots—sign certs for internal services only. You install the private root on employee laptops or cluster trust stores.

For a public Laravel storefront like Quick And Easy Nepalese Grocery, public CA certs are mandatory. For service-to-service calls inside a VPC, private PKI with mutual TLS reduces exposure. Compare approaches in our multi-cloud secrets management and HashiCorp Vault secrets articles when certs live beside API keys.

The CA/Browser Forum Baseline Requirements govern public issuers. Shorter maximum lifetimes push teams toward automation. Manual annual renewals are a liability in 2026.

How do you renew and rotate certificates without downtime?

Renewal replaces a cert before expiry with the same key or a new key. Rotation implies replacing the key pair, which is stronger after staff changes or suspected compromise. Both require reloading the TLS terminator without dropping active connections.

Zero-downtime reload patterns

Apache and Nginx support graceful reload. PHP-FPM does not need a restart for cert changes unless you terminate TLS inside PHP, which you should not.

sudo nginx -t && sudo systemctl reload nginx
sudo apachectl configtest && sudo systemctl reload apache2

On Deployer 7 releases I use for sister legal-tech sites, cert paths stay in shared directories outside the release symlink. The web server points to /etc/letsencrypt/live/domain/, not current/public. Renewals never touch application code.

Load balancers need the full chain uploaded. A common mistake is sending only the leaf cert. Clients fail chain validation when intermediates are missing. Always bundle:

cat fullchain.pem  # leaf + intermediate(s)
# privkey.pem stays on server only

Rotation checklist for production

1. Generate new key and CSR, or let ACME client handle both.
2. Issue new cert and validate chain with openssl verify.
3. Deploy to staging; run SSL Labs or curl -vI https://staging.example.com.
4. Deploy to production during low traffic; reload, do not restart.
5. Confirm monitoring green for 24 hours.
6. Revoke old cert if key material may have leaked.

Client-facing portals such as Mijar Law Associates cannot afford document-upload downtime. Schedule rotation in off-peak windows and keep the previous cert until the new one proves stable.

How do you troubleshoot common PKI and certificate management problems?

Most incidents fall into four buckets: expiry, name mismatch, broken chain, and clock skew. Start with observable symptoms, then validate the cert programmatically.

Diagnose handshake and chain errors

curl -vI https://example.com 2>&1 | grep -E "subject:|issuer:|expire|SSL certificate"
openssl s_client -connect example.com:443 -showcerts < /dev/null
openssl verify -CAfile chain.pem cert.pem

ERR_CERT_DATE_INVALID means expired or not yet valid. Renew immediately. ERR_CERT_COMMON_NAME_INVALID usually means SAN does not list the hostname you typed. Wildcard certs cover one level only; *.example.com does not cover api.staging.example.com.

unable to get local issuer certificate signals a missing intermediate. Download the issuer bundle from your CA and concatenate it. The OpenSSL project documents chain building in their verification options manual.

Integrate PKI with application and API layers

Laravel apps behind TLS still need correct APP_URL=https:// and trusted proxy configuration. Payment gateway callbacks—eSewa, Khalti, Stripe—reject mismatched callback URLs when certs fail mid-flow. For API projects, document mTLS requirements in OpenAPI specs. Our API development practice treats cert pinning and webhook TLS as part of the contract, not ops afterthoughts.

Kubernetes ingress controllers store certs as Secrets. Rotation means updating the Secret and letting the controller reload. See Kubernetes secrets management done right for naming and access patterns. Azure Key Vault can issue and store certs for App Service; the Azure Key Vault guide covers import versus managed issuance.

Generate strong keys for CSRs with our password generator mindset applied to entropy—use 2048-bit RSA minimum or prefer ECDSA P-256 where clients support it.

Compliance and audit hooks

ISO 27001 and client security questionnaires ask for key length, CA source, renewal process, and revocation steps. Map your runbooks to control language early. Our ISO 27001 basics for engineers article aligns well with PKI documentation requirements.

Legal-tech portals handling client documents benefit from strict TLS configs plus HSTS headers. Combine cert management with testing and optimization passes that include SSL Labs scans. Vulnerability scanners flag weak ciphers separately from expiry; treat both streams in vulnerability management automation.

Domain and DNS ownership underpins domain-validated certs. If DNS lapses, an attacker can obtain a valid cert for your hostname. Keep registrar locks and auto-renew enabled through your registrar workflow described in domain registration and hosting.

Key Takeaways

• PKI trust chains run root CA → intermediate → leaf; browsers fail closed when any link is missing or expired.
• Maintain a central inventory with hostname, issuer, expiry, install location, and owner for every cert in production and staging.
• Automate renewal with ACME (Certbot) and verify timers with certbot renew --dry-run at least quarterly.
• Upload full certificate chains to load balancers and CDNs; leaf-only uploads cause subtle mobile client failures.
• Rotate keys after personnel changes or suspected compromise, and revoke old certificates through the CA portal.
• Map every TLS termination layer—edge, origin, internal mTLS—because one expired cert anywhere breaks the user journey.

People Also Ask

What is the difference between a certificate and a key?

A certificate is a signed public document containing your public key plus identity metadata. The private key stays secret on the server and proves you own the cert during TLS handshakes. You can reissue a certificate with the same key, but best practice rotates both after security events.

How long do SSL certificates last in 2026?

Let's Encrypt issues 90-day certificates by default, encouraging automation. Public CAs under CA/Browser Forum rules continue shortening maximum lifetimes. Plan for quarterly renewals rather than annual calendar reminders.

Do I need a wildcard certificate?

Wildcard certs cover unlimited subdomains at one DNS level (*.example.com). SAN certificates listing explicit hostnames are often safer and cheaper for small sites. Use wildcards only when you frequently spin up unpredictable subdomains.

What happens if my SSL certificate expires?

Browsers display interstitial warnings and block form submission on many devices. API clients may throw TLS errors silently, breaking payment webhooks and mobile apps. Monitoring with 30-day alerts prevents most outages; keep a manual issuance runbook for CA outages.

Ship trustworthy HTTPS without certificate surprises

PKI and certificate management basics are infrastructure hygiene, not optional security theatre. Inventory your certs, automate ACME renewal, validate chains after every deploy, and document rotation for your team. Whether you run a law portal, eCommerce store, or internal API mesh, the pattern is identical: know what you have, renew before expiry, and test from the client's perspective.

Need help auditing TLS across a multi-site Deployer fleet or setting up monitored Certbot on Ubuntu? Review our Notary Nepal and sister-site work in the portfolio, then reach out through contact us or explore support and maintenance for ongoing certificate monitoring. For mobile clients calling your APIs, also read mobile app security basics and keep web development and hosting under one accountable workflow.