A Blockchain-Native PKI: Secure X.509 Certificate Management on the XRP Ledger

Abstract

Public Key Infrastructure (PKI) is foundational to secure digital communication, yet its traditional reliance on centralized Certificate Authorities (CAs) introduces significant risks, costs, and operational bottlenecks. This paper presents a novel, fully decentralized approach to PKI by leveraging the XRP Ledger (XRPL) blockchain for the issuance, storage, retrieval, and revocation of X. 509 certificates. The core methodology stores certificates directly within XRPL transactions using the native Memos field, offering a lightweight, immutable, and cost-effective solution without requiring modifications to the underlying protocol. To enhance certificate lifecycle management and enable native on-chain revocation, we also introduce a complementary approach that uses Non-Fungible Tokens (NFTs) to store certificate data and metadata. NFT-based storage supports features such as instant revocation through burning or flagging, and enables additional transparency and auditability. Certificate retrieval involves querying transaction history or owned NFTs, decoding and reassembling the data if chunked, and validating the reconstructed X. 509 certificate using standard tools. We implement a Python-based web application that exposes RESTful APIs for certificate lifecycle management, secure messaging, and encrypted email, demonstrating seamless integration with existing PKI-aware applications. Our evaluation shows that this architecture drastically reduces operational costs compared to traditional CAs while enhancing transparency, auditability, and resilience. This work demonstrates the feasibility and advantages of blockchain-native PKI, paving the way for scalable, trustminimized, and user-centric digital identity management.