PK-WHY: Demystifying Public Key Infrastructure in Cloud Architectures
Kevin Chen breaks down Public Key Infrastructure (PKI) concepts, removing the intimidation around TLS certificates, trust chains, and cloud CAs.
Summary
The Intimidation Factor of Public Key Infrastructure
Public Key Infrastructure (PKI) and X.509 certificates form the cryptographic backbone of cloud communications, yet developers and security engineers often avoid auditing them.
Demystifying Certificates and Trust Chains
Kevin Chen explains the fundamentals of asymmetric key generation, Certificate Authorities (CAs), root trust stores, and intermediate certificate validation.
Common PKI Implementation Pitfalls in Cloud Systems
Chen reviews common operational mistakes—such as hardcoded private keys, disabled certificate verification, and improper wildcards in cloud load balancers.
Modern Automated Certificate Management
The author demonstrates using automated protocols (ACME, AWS Certificate Manager, HashiCorp Vault) to eliminate manual certificate rotations and manage mTLS securely.
Related talks
Village Presentations·22 min
Nick Sullivan
Cloudflare head of cryptography Nick Sullivan introduces CFSSL, an open-source Go toolkit for automated TLS certificate authority operations and PKI bundling.
Main Stage·50 min
Aapo Oksman
Aapo Oksman introduces certmitm, an automated tool designed to discover and exploit insecure TLS client certificate validation flaws across iOS, Windows 11, and embedded devices.
Crypto and Privacy Village·44 min
Analyzing certificate revocation protocols including CRL and OCSP, exploring the systemic vulnerabilities and privacy leaks undermining public PKI.