> A printable A3 poster that explains, in eight pictures, how your browser decides to trust a website: key pairs, hashes, signatures, certificates, the chain of trust and the TLS handshake. Source: https://pkizerotohero.com/poster/ · Last reviewed: 2026-10-20 Poster # PKI on one page A poster that explains, in eight numbered pictures, how your browser decides to trust a website. Print it for a classroom or an office wall. - [Beginner](https://pkizerotohero.com/start/#beginner) - [Teacher](https://pkizerotohero.com/start/#teacher) - [Leader](https://pkizerotohero.com/start/#leader) [Download PDF (A3)](https://pkizerotohero.com/poster/pki-on-one-page-a3.pdf)[Download PNG](https://pkizerotohero.com/poster/pki-on-one-page.png) PDF, 39 KB. PNG, 1684 × 2382 pixels, 355 KB. Also as an [SVG](https://pkizerotohero.com/poster/pki-on-one-page.svg) for very large prints. Last reviewed 20 October 2026 *Diagram: PKI on one page: how your browser decides to trust a website, in eight numbered panels: 1. One key or two?; 2. A fingerprint (hash); 3. A signature; 4. A certificate; 5. The chain of trust; 6. The TLS handshake; 7. When trust breaks; 8. Shorter lives ahead. Rosa, the key holder, signs; Ken, the relying party, checks.* Rosa, the key holder, signs. Ken, the relying party, checks. Read the panels in order: each one builds on the one before. ## Teaching with it? The [For teachers](https://pkizerotohero.com/teachers/) page has a complete 45-minute lesson with an unplugged padlock activity, discussion questions and a printable worksheet. The poster makes a good recap on the wall afterwards. ## The poster, panel by panel Each panel in bigger type, with a little more explanation and where to read on. ### 1 One key or two? With one shared key, both sides need a copy of the same secret. A key pair is two keys made together: the public key may be shared with anyone, the private key never leaves its owner. [Lesson 2: Two keys](https://pkizerotohero.com/course/two-keys/) ### 2 A fingerprint (hash) A hash turns any data into a short fingerprint. Change a single character and the fingerprint changes completely, and there is no practical way back from the fingerprint to the data. [Handbook: Hashes and fingerprints](https://pkizerotohero.com/handbook/hashes/) ### 3 A signature Rosa signs with her private key. Anyone can check the signature with her public key. If one letter changes, the check fails. Signing does not hide the message: it stays readable. [Handbook: Digital signatures](https://pkizerotohero.com/handbook/digital-signatures/) ### 4 A certificate A certificate ties a name to a public key. A certificate authority (CA) checks that the name is really yours, then signs the certificate. [Handbook: Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/) ### 5 The chain of trust The website sends its own certificate and the intermediate CA's certificate. Each certificate is signed by the next one up, and the browser checks every signature until it reaches a root that is already in its trust store. The root is trusted because it is in the trust store, not because it signed itself. [Handbook: Certificate chains](https://pkizerotohero.com/handbook/certificate-chains/) ### 6 The TLS handshake In TLS 1.3, the browser and the website first agree on fresh session keys (ECDHE), which will encrypt the conversation. The website then sends its certificate chain and signs the handshake with its private key, which proves it holds the key that belongs to the name. The certificate itself encrypts nothing. [Handbook: The TLS 1.3 handshake](https://pkizerotohero.com/handbook/tls-handshake/) ### 7 When trust breaks Trust breaks when a certificate has expired, has been revoked (cancelled early by its CA, for example after its private key leaked) or was made for a different name. Browsers do not always notice a revocation, which is one reason certificate lifetimes are getting shorter. Public Certificate Transparency logs let anyone spot a certificate that should not exist. [Lesson 8: When trust breaks](https://pkizerotohero.com/course/when-trust-breaks/) ### 8 Shorter lives ahead Under the CA/Browser Forum rules, the longest a public website (TLS) certificate may be valid keeps shrinking: 398 days from 2020, 200 days from 2026, 100 days from 2027, 47 days from 2029. From 15 March 2029, the maximum is 47 days, so certificates must be renewed at least eight times a year. Automate renewal with ACME. [What's changing in PKI](https://pkizerotohero.com/changes/) ## How do I print it? - **A3 is best.** Print the PDF at actual size (100%). The main text is then 18 point. - **A4 works too.** Choose "Fit to page". Everything shrinks to about 13 point: fine for a desk or a noticeboard. - **Black and white is fine.** Every valid or invalid state has an icon and a word as well as a colour. - **The Print button** on this page prints only the poster, scaled to your paper. ## Are the dates up to date? The certificate lifetimes and dates on the poster come from our list of checked facts, last checked on 20 October 2026. When a rule changes, we update the poster, so download a fresh copy now and then. [What's changing in PKI](https://pkizerotohero.com/changes/) follows the schedule. ## May I use it? Yes. Print it, hang it up and share it in class, as long as you name the source ("PKI Zero to Hero, pkizerotohero.com"). The [terms of use](https://pkizerotohero.com/legal/terms/) have the details. **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/poster/).