Learn PKI - Pre-Requisites Skills & Setup Environment

#Introduction

Welcome to the Learn PKI series! This series will take you through mastering Public Key Infrastructure (PKI), the digital certificate ecosystem that keeps communication on the internet secure, from cryptographic foundations to building a production-ready private CA. The series covers a total of six episodes, starting from environment setup to trust store distribution.

But before creating your first certificate, there are a number of foundational skills and tools you must have. Why are these pre-requisites important? Because PKI stands on public key cryptography concepts wrapped in the standard X.509 format and managed through command line tooling. If you do not yet understand the difference between a public key and a private key, or you are not comfortable working in a terminal, the material in the following episodes will be hard to digest.

Imagine wanting to become a network security architect without understanding how keys and certificates work. However brilliant the concept, it is still difficult to build digital trust without understanding its foundations. Episode 0 is your roadmap: we will prepare the foundational skills, make sure OpenSSL is installed, and then choose the CA software that will accompany you throughout the series.

#Foundational Skills You Must Master

#Public Key Cryptography Basics

Public key cryptography, or asymmetric cryptography, is the foundation of all of PKI. Every entity has a pair of keys: a private key that is kept secret and a public key that can be freely shared. Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa.

The two most widely used algorithm families are RSA, based on the factorization of large prime numbers up to 4096 bits, and EC (elliptic curve) such as P-256 and P-384, which are more efficient at the same key size. Understand the trade-offs: RSA is supported almost everywhere and easy to understand, while EC provides equivalent strength with shorter keys and faster operations.

#Hash and Digital Signature

A hash function turns data of any length into a fixed-length value. SHA-256, for example, always produces 32 bytes regardless of the input length. Hashes are used to ensure integrity: if even a tiny bit of data changes, the hash changes completely.

A digital signature is a combination of a hash and a private key. The signer hashes the message and then encrypts it with their private key. Anyone with the public key can verify that the message genuinely came from the owner of that private key and was not modified. In PKI, it is this signature that links a child certificate to its issuing authority, giving birth to an interlocking chain of trust.

#Linux CLI and Understanding TLS

All the hands-on practice in this series happens in a Linux terminal. You need to be comfortable moving between directories, reading output, and running commands with arguments. Get into the habit of checking the manual when you are unsure, for example with man openssl or openssl help.

Finally, understand TLS, the protocol that encrypts communication between clients and servers. TLS is the largest consumer of X.509 certificates: when a browser opens a website, the server certificate is checked against the local trust store, and that is PKI at work every day. In episode 1 we will discuss its history and background in depth.

#Software You Need to Prepare

#OpenSSL: Version 4.x or LTS 3.5

The main tool throughout this series is OpenSSL. In 2026, OpenSSL 4.0 is the latest release, while the 3.5 branch is the most stable Long Term Support option for production. Both are worth using; what matters is not the version number, but that you are comfortable with its basic commands.

openssl version -a

Look at the first line of the output: OpenSSL 3.x.x or OpenSSL 4.x.x. This command shows the version, release date, configuration directory, and the list of available providers. This is where we begin reading the state of your tooling.

#Lab VM or Container

It is best not to practice on your main machine. Prepare a Linux-based VM or container, for example Debian, Ubuntu, or Rocky Linux. This lab can be destroyed and recreated without fear, which is very useful when we deliberately create certificates with wrong configurations just for learning.

mkdir -p ~/lab-pki/root-ca
mkdir -p ~/lab-pki/intermediate-ca
mkdir -p ~/lab-pki/leaf
cd ~/lab-pki
ls -R

The root-ca, intermediate-ca, and leaf folders will be the home for each part of the PKI hierarchy we build starting in episode 4.

#Lab Domain and DNS (Optional)

To test certificates actually used by a server, it is very helpful to have a lab domain with DNS pointing to your environment, for example lab.example.test. The .test TLD is guaranteed never to be used on the public internet, so it is safe for practice. This part is optional; for episodes 3 and 4, host names in the SAN are sufficient.

#Choosing CA Software

Throughout this series we focus on the OpenSSL-based CA, a certificate authority built directly from the OpenSSL tool. But also get to know the alternatives so your horizons stay broad:

• OpenSSL CA: simple, free, pure CLI, best suited for learning and internal labs.
• step-ca: friendly CLI from Smallstep, well suited for modern labs and automation.
• CFSSL: Go toolkit from Cloudflare, flexible for enterprise needs.
• Vault PKI: integrated with secret management, suitable for enterprise production.

Choosing this software is not required now, but think about the direction of your learning. We will cover the OpenSSL CA in depth, and the experience of building it will make other software easier to understand because the concepts are the same.

#Setting Up Your Editor and References

To write configuration files and read certificate output, any text editor is sufficient, including VS Code and Vim. The most helpful features are syntax highlighting for configuration files and an integrated terminal, because most PKI work happens in those two places at once.

Also keep references at your fingertips: the OpenSSL manual man openssl, the X.509 documentation, and the notes from this series' episodes. Reading long certificate output becomes much easier once you know which fields matter, and we will start mapping those fields in detail in episode 2.

As a small exercise, run the verification command above once more from inside your newly created lab folder. The habit of repeating verification at the start of every learning session will keep your environment healthy and reduce errors that are hard to trace.

#Environment Verification

Before moving on, make sure all pre-requisites are met by running the following verification suite:

openssl version -a
uname -a
openssl rand -hex 16

The uname -a command shows the kernel and system architecture, while openssl rand -hex 16 verifies that the random number generator works — an essential component when creating keys.

#Episode 0 Checklist Summary

• Understand the basics of public key cryptography: public/private key, RSA/EC, hash, digital signature.
• Comfortable with the Linux CLI and understand the role of TLS in using certificates.
• OpenSSL version 4.x or 3.5 LTS installed and verified.
• A lab VM or container ready for practice.
• The lab folder structure root-ca, intermediate-ca, and leaf has been created.
• Chose the CA software direction: OpenSSL CA as the main focus of this series.
• Editor and references prepared for writing configuration in practice.

#Closing

In episode 0 you have laid the foundation for the entire series: understanding the foundational cryptography and TLS skills, making sure OpenSSL and the lab container are ready, and setting the learning direction with the OpenSSL CA. Without this foundation, the practice in the following episodes will feel heavy.

Key takeaways:

• Public key cryptography is the foundation of PKI; master public/private keys, RSA/EC, hash, and digital signatures.
• TLS is the largest consumer of X.509 certificates, so understand its role before diving deep into PKI.
• OpenSSL version 4.x or 3.5 LTS is the main tool throughout the series.
• Practice in a lab VM or container so you can experiment safely.
• A tidy lab folder structure makes managing the CA hierarchy easier later.

In the next episode, episode 1, we will discuss history, background, and why the world needs PKI — from Diffie-Hellman and RSA, the birth of X.509, the evolution of SSL toward TLS, to today's post-quantum trends. Make sure your environment is ready, because the Learn PKI journey has only just begun!