0 views
Read
#0
Learn PKI - Pre-Requisites Skills & Setup Environment
Before touching your first CA, you need to master the basics of cryptography, the Linux CLI, and TLS concepts, while also preparing tools such as OpenSSL, a lab container, and choosing the CA software you will study throughout this Learn PKI series.
August 3, 2026
00
Read
#1
Learn PKI - History, Background & Why You Need It
This episode traces the history of public key cryptography from Diffie-Hellman and RSA, the birth of X.509, the evolution of SSL toward TLS, to modern trends such as mTLS zero trust and the post-quantum transition that are changing how the world builds digital trust.
August 3, 2026
00
Read
#2
Learn PKI - Core Concepts & Main Architecture
This episode dissects the X.509 certificate anatomy, the role of CSR, how the chain of trust works, and the PKI hierarchy with Root CA and Sub CA, including the issuance, verification, and revocation flows through CRL and OCSP.
August 3, 2026
00
Read
#3
Learn PKI - OpenSSL: Key, CSR & Self-Signed Certificates
Hands-on practice with OpenSSL: creating RSA and EC key pairs with genpkey, generating CSRs with req, issuing self-signed certificates with x509, extracting public keys, and learning about the default and legacy providers.
August 3, 2026
00
Read
#4
Learn PKI - Building a Private CA (Offline CA with OpenSSL)
Build a two-tier private CA: a tightly guarded offline Root CA, an online Intermediate CA for issuance, openssl.cnf configuration, the index and serial structure, and CSR signing practice with serverAuth and SAN extensions.
August 3, 2026
00
Read
#5
Learn PKI - Trust Store & Root Certificate Distribution
Placing the root certificate into the trust stores of systems, browsers, and applications such as Java and Python, understanding CA bundles, and verifying the chain with openssl verify using -CAfile and -untrusted.
August 3, 2026
00
Read
#6
Learn PKI - Revocation: CRL & OCSP
This episode covers the two certificate revocation mechanisms: CRL as a periodic blacklist and OCSP as a real-time status service, complete with generating, publishing, and integrating OCSP Stapling into the TLS handshake.
August 3, 2026
00
Read
#7
Learn PKI - TLS Server & Client Certificates (mTLS)
This episode covers installing server TLS certificates with the correct chain and SAN, testing the handshake with openssl s_client, and implementing mutual TLS with client certificates for two-way authentication on internal APIs and service mesh.
August 3, 2026
00
Read
#8
Learn PKI - ACME Protocol & Let's Encrypt
This episode dissects ACME RFC 8555 from order to issuance, the three challenge types, External Account Binding, then Let's Encrypt practice with certbot, rate limit management, automatic renewal, and the trends of short-lived certificates and ACME Profiles.
August 3, 2026
00
Read
#9
Learn PKI - step-ca: Modern Private CA
This episode covers step-ca version 0.30, Smallstep's modern private CA: init and bootstrap, various provisioners such as JWK and ACME, template-based issuance, SSH certificate authority, plus the SCEP security fix for CVE-2026-30836.
August 3, 2026
00