Information, Technology & Consulting

Frequently Asked Questions about PKI


What is PKI?

PKI is the acronym for Public Key Infrastructure. The technology is called Public Key because, unlike earlier forms of cryptography, it works with a pair of keys. One of the two keys can be used to encrypt information that can only be decrypted with the other key. One key is made public and the other is kept secret. The secret key is usually called the private key. Since anyone can obtain the public key, users can initiate secure communications without having to previously share a secret through some other medium with their correspondent. The infrastructure is the underlying system needed to issue keys and certificates and to publish the public information.

Public Key Certificates

A public key needs to be associated with the name of its owner. This is done by using a public key certificate, which is a data structure containing the owner's name, their public key and email address, validity dates for the certificate, the location of revocation information, the location of the issuer's policies, and possibly other information such as their affiliation with the certificate issuer (often an employer or institution). The certificate data structure is signed with the private key of the issuer so that a recipient can verify the identity of the signer and prove that the data in the certificate has not been altered. Public Key Certificates are then published, often in an LDAP directory, so users of PKI can locate the certificate for an individual with whom they wish to communicate securely.

Encryption and Signing

A secret key allows two transformations of data to occur. Plain text is transformed to cipher text, which is unreadable until it is transformed back to plain text using the secret key. A public key system uses the Encrypt and Decrypt functions to implement two primitive operations, data encryption and signatures.

To encrypt data, the public key of the recipient is used to transform a plain text message to cipher text. The cipher text of the message can be converted back to plain text only by using the corresponding private key. Since this private key is known only by the intended recipient, only that individual can decrypt the message.

A signature is created by transforming plain text to cipher text using the private key of the signer. A signature is verified by looking up the public key of the signer and attempting to transform the cipher text of the signature back to plain text. If the operation is successful, it verifies that the data encryption was done with the corresponding private key. This implies that the signature was produced by the owner of that private key.

Using PKI for Authentication

Getting a Certificate

Contact [email protected] and request information on how to obtain one.

How Do I Renew an Expired Certificate?

Once a certificate expires, a new one will have to be obtained.

How Often Do I Need to Get a New Certificate?


PKI certificates issued by Dartmouth College are currently valid for three years.

How Do I Recover a Forgotten Password for My Certificate?

At this time there is no way to recover a forgotten password for a certificate.


Computer and Device Services
Desktops and Laptops
Last updated: 
Friday, October 20, 2017

If you have questions or need further information, contact your department's IT support office, or contact the IT Service Desk via email at [email protected], via phone at 603-646-2999 or walk in to see them in Baker/Berry 178J.

Information, Technology & Consulting