PKI: It's Not Dead, Just Resting

Despite enthusiastic predictions in the trade press, an X.509-style PKI has so far failed to eventuate to any significant degree. This paper looks at some of the reasons behind this, examining why a pure X.509-style PKI may never appear outside a few closed, highly-controlled environments such as government agencies. On the other hand there are many instances in which situationand application-specific uses of certificates can be employed in a manner that avoids the shortcomings of X.509’s one-size-(mis)fits-all approach. The paper examines a number of these situation-specific approaches to working with certificates, and concludes with a collection of useful design rules to consider before embarking on a PKI project.