Orthevs Orthevs Fathom new horizons
Menu

PKI · PKI & trust chains

Certificate Authority Workshop

From X.509 foundations through root and intermediate CAs, certificate chains and revocation to automation, audit, key compromise and recovery.

Workshop examples as ZIP files · 31 Workshop wiki Back to the Academy

Certificate Authority

My learning progress

With the web app option enabled, your progress is stored on this device.

Learning progress in the web app

Mark chapters as read, view reading progress and check off practice modules after enabling the optional web app. Workshop progress is calculated from chapters across all document pages. Your choices stay on this device; there is no account or server sync. Installation is not required. Withdrawing your choice in Privacy settings deletes the progress.

Workshop progress0%
Practice modules completed0 / 31
Documents read0 / 98
Workshop progress0%
0%
0 / 1162 chapters read

Orthevs Academy · Orthevs

Certificate Authority as a learning path

This learning path provides knowledge and practice. Requirements, ownership and evidence must be defined separately for production Orthevs processes.

Technical workshop

One learning framework. Distinct technical subjects.

All workshops follow the same robust topology: central documentation, progressive workshop levels, exercises, assessments, runnable examples and supporting scripts. The Academy preserves this organization instead of dissolving the material into isolated articles or decorative course cards.

Learning material

Documentation in the Orthevs Wiki

The material retains its subject-specific structure. German and English versions are cross-linked, and diagrams are generated directly from the included Mermaid sources.

Workshop overview

1
English · 2.0 KB

Certificate Authority Workshop – Overview

This workshop covers the path from X.509 fundamentals to operational PKI and CA security models. Its structure follows the Kubernetes works…

Open document ↗

Technical documentation

13
English · 64.5 KB

Architecture: Certificate Authority

PKI Trust Model is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 67.2 KB

Best Practices: Certificate Authority

PKI Design is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 72.3 KB

Command Reference: Certificate Authority

OpenSSL Ground Rules is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 64.3 KB

Concepts: Certificate Authority

X.509 is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 75.2 KB

Curriculum: Certificate Authority

Curriculum Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 51.6 KB

Diagrams: Certificate Authority

Overall Architecture is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 51.5 KB

Remote and Cloud Environments: Certificate Authority

Purpose is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 49.2 KB

Ubuntu on Bare Metal: Certificate Authority

Purpose is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 51.4 KB

Ubuntu in a VM: Certificate Authority

Purpose is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 51.4 KB

Ubuntu on WSL: Certificate Authority

Purpose is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 62.2 KB

Operations: Certificate Authority

Operating Model is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 64.4 KB

Security: Certificate Authority

Threat Model is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 70.1 KB

Troubleshooting: Certificate Authority

Diagnostic Sequence is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗

Workshop levels

4
English · 77.6 KB

Certificate Authority Workshop: Fundamentals (EN)

!Certificate Authority Fundamentals

Open document ↗ English · 77.7 KB

Certificate Authority Workshop: Intermediate (EN)

!Certificate Authority Intermediate

Open document ↗ English · 77.7 KB

Certificate Authority Workshop: Professional (EN)

!Certificate Authority Professional

Open document ↗ English · 77.8 KB

Certificate Authority Workshop: Advanced + Security (EN)

!Certificate Authority Advanced + Security

Open document ↗

Exercises

4
English · 68.8 KB

Certificate Authority Workshop: Fundamentals – Exercises with Solutions

Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 68.9 KB

Certificate Authority Workshop: Intermediate – Exercises with Solutions

Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 68.9 KB

Certificate Authority Workshop: Professional – Exercises with Solutions

Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 69.1 KB

Certificate Authority Workshop: Advanced + Security – Exercises with Solutions

Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗

Assessments and solutions

9
English · 76.5 KB

CA Assessment: 01 Fundamentals

Assessment Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 93.9 KB

Model Solution: CA Assessment 01 – Fundamentals

Usage Notes is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 76.6 KB

CA Assessment: 02 Intermediate

Assessment Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 94.1 KB

Model Solution: CA Assessment 02 – Intermediate

Usage Notes is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 76.6 KB

CA Assessment: 03 Professional

Assessment Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 94.1 KB

Model Solution: CA Assessment 03 – Professional

Usage Notes is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 76.8 KB

CA Assessment: 04 Advanced + Security

Assessment Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 94.3 KB

Model Solution: CA Assessment 04 – Advanced + Security

Usage Notes is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.

Open document ↗ English · 24.2 KB

Official Certificates and Standards: Certificate Authority

This document does not invent a certification. There is no single universal vendor-neutral credential that replaces the whole CA workshop. The relevant anchors are standards, policies, audits, and role-specific security certifications.

Open document ↗
View all content in the wiki

Practice modules

Workshop examples as ZIP files

All 31 practice examples in this workshop are available as individual ZIP files. Choose an example to download its package directly.

00

lab-skeleton

examples/00-lab-skeleton
Files
7
Size
14.7 KB
SHA-256
760004f17720
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
01

inspect-certificates

examples/01-inspect-certificates
Files
7
Size
14.9 KB
SHA-256
b068e332664c
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
02

root-ca

examples/02-root-ca
Files
7
Size
14.6 KB
SHA-256
de66acb02376
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
03

intermediate-ca

examples/03-intermediate-ca
Files
7
Size
14.8 KB
SHA-256
7b5daaeefd02
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
04

server-csr

examples/04-server-csr
Files
7
Size
14.7 KB
SHA-256
21cdf4be8f4a
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
05

sign-server-cert

examples/05-sign-server-cert
Files
7
Size
14.7 KB
SHA-256
8d57e47dfc11
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
06

chain-verify

examples/06-chain-verify
Files
7
Size
14.8 KB
SHA-256
8eb2146fbfbf
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
07

san-certificate

examples/07-san-certificate
Files
7
Size
14.8 KB
SHA-256
52a444a16816
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
08

client-certificate

examples/08-client-certificate
Files
8
Size
15.4 KB
SHA-256
fe9bd49e0ea9
Files in the ZIP · 8
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/client.cnf
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
09

mtls-nginx-model

examples/09-mtls-nginx-model
Files
9
Size
15.9 KB
SHA-256
9856c86adf13
Files in the ZIP · 9
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • nginx/mtls-server.conf
  • openssl/client.cnf
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
10

crl-generation

examples/10-crl-generation
Files
8
Size
15.5 KB
SHA-256
19a9be38c6bf
Files in the ZIP · 8
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/ca-database.cnf
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
11

revoke-certificate

examples/11-revoke-certificate
Files
8
Size
15.6 KB
SHA-256
19d92e8c5ac7
Files in the ZIP · 8
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/ca-database.cnf
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
12

ocsp-response-model

examples/12-ocsp-response-model
Files
8
Size
15.8 KB
SHA-256
d0e26173516f
Files in the ZIP · 8
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/ca-database.cnf
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
13

key-algorithms

examples/13-key-algorithms
Files
4
Size
13.0 KB
SHA-256
4ea5cd12bf0f
Files in the ZIP · 4
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • run.sh
Download example ZIP Open in the wiki
14

certificate-extensions

examples/14-certificate-extensions
Files
7
Size
15.0 KB
SHA-256
6510dff27948
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
15

name-constraints-lab

examples/15-name-constraints-lab
Files
7
Size
15.1 KB
SHA-256
2a520fddfc20
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
16

pathlen-basicconstraints

examples/16-pathlen-basicconstraints
Files
7
Size
15.2 KB
SHA-256
80ca3784f3de
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
17

trust-store-model

examples/17-trust-store-model
Files
7
Size
14.9 KB
SHA-256
71338e7f6abc
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
18

renewal-rotation

examples/18-renewal-rotation
Files
7
Size
14.9 KB
SHA-256
88011779a770
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
19

expiry-monitoring

examples/19-expiry-monitoring
Files
7
Size
15.0 KB
SHA-256
db2a20830ad2
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
20

acme-flow-model

examples/20-acme-flow-model
Files
5
Size
13.7 KB
SHA-256
2a06e1f6d907
Files in the ZIP · 5
  • README.md
  • acme/acme-flow.yml
  • docs/de/README.md
  • docs/en/README.md
  • run.sh
Download example ZIP Open in the wiki
21

certbot-model

examples/21-certbot-model
Files
6
Size
14.2 KB
SHA-256
6f1726318319
Files in the ZIP · 6
  • README.md
  • certbot/renewal-example.conf
  • docs/de/README.md
  • docs/en/README.md
  • nginx/example-http01.conf
  • run.sh
Download example ZIP Open in the wiki
22

vault-pki-model

examples/22-vault-pki-model
Files
6
Size
14.0 KB
SHA-256
5d8812d86c22
Files in the ZIP · 6
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • run.sh
  • vault/pki-commands.sh
  • vault/pki-policy.hcl
Download example ZIP Open in the wiki
23

cert-manager-model

examples/23-cert-manager-model
Files
6
Size
14.0 KB
SHA-256
ff32a42d40c4
Files in the ZIP · 6
  • README.md
  • cert-manager/certificate.yaml
  • cert-manager/issuer.yaml
  • docs/de/README.md
  • docs/en/README.md
  • run.sh
Download example ZIP Open in the wiki
24

step-ca-model

examples/24-step-ca-model
Files
5
Size
13.6 KB
SHA-256
87fd51522179
Files in the ZIP · 5
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • run.sh
  • step-ca/ca.json
Download example ZIP Open in the wiki
25

spiffe-spire-model

examples/25-spiffe-spire-model
Files
6
Size
14.1 KB
SHA-256
6955298cc92b
Files in the ZIP · 6
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • run.sh
  • spiffe/registration-entry.json
  • spiffe/spire-server.conf
Download example ZIP Open in the wiki
26

hsm-offline-root-model

examples/26-hsm-offline-root-model
Files
6
Size
14.3 KB
SHA-256
d88201938060
Files in the ZIP · 6
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • hsm/offline-root-ceremony.md
  • hsm/pkcs11-openssl.cnf
  • run.sh
Download example ZIP Open in the wiki
27

policy-cps-template

examples/27-policy-cps-template
Files
5
Size
14.0 KB
SHA-256
d470fd1d5c25
Files in the ZIP · 5
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • policy/cp-cps-template.md
  • run.sh
Download example ZIP Open in the wiki
28

audit-log-model

examples/28-audit-log-model
Files
6
Size
14.0 KB
SHA-256
5c51c3e891af
Files in the ZIP · 6
  • README.md
  • audit/audit-events.jsonl
  • audit/evidence-checklist.md
  • docs/de/README.md
  • docs/en/README.md
  • run.sh
Download example ZIP Open in the wiki
29

incident-response-revocation

examples/29-incident-response-revocation
Files
9
Size
16.6 KB
SHA-256
1d2b46947695
Files in the ZIP · 9
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • incident/revocation-runbook.md
  • openssl/ca-database.cnf
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki
30

troubleshooting-chain

examples/30-troubleshooting-chain
Files
7
Size
15.0 KB
SHA-256
9ff19271425e
Files in the ZIP · 7
  • README.md
  • docs/de/README.md
  • docs/en/README.md
  • openssl/intermediate-ca.cnf
  • openssl/root-ca.cnf
  • openssl/server.cnf
  • run.sh
Download example ZIP Open in the wiki

Material structure

The workshop's real directory structure.

Each area can be opened separately. Directories and material files appear in their actual hierarchy with their unchanged paths; the media directory is excluded in full.

Root files

README-EN.md
Documentation39
docs/architecture-certificate-authority-DE.md
docs/architecture-certificate-authority-EN.md
docs/architecture-certificate-authority-EL.md
docs/best-practices-certificate-authority-DE.md
docs/best-practices-certificate-authority-EN.md
docs/best-practices-certificate-authority-EL.md
docs/commands-certificate-authority-DE.md
docs/commands-certificate-authority-EN.md
docs/commands-certificate-authority-EL.md
docs/concepts-certificate-authority-DE.md
docs/concepts-certificate-authority-EN.md
docs/concepts-certificate-authority-EL.md
docs/curriculum-certificate-authority-DE.md
docs/curriculum-certificate-authority-EN.md
docs/curriculum-certificate-authority-EL.md
docs/diagrams-certificate-authority-DE.md
docs/diagrams-certificate-authority-EN.md
docs/diagrams-certificate-authority-EL.md
docs/environment-cloud-certificate-authority-DE.md
docs/environment-cloud-certificate-authority-EN.md
docs/environment-cloud-certificate-authority-EL.md
docs/environment-native-baremetal-certificate-authority-DE.md
docs/environment-native-baremetal-certificate-authority-EN.md
docs/environment-native-baremetal-certificate-authority-EL.md
docs/environment-native-vm-certificate-authority-DE.md
docs/environment-native-vm-certificate-authority-EN.md
docs/environment-native-vm-certificate-authority-EL.md
docs/environment-wsl-certificate-authority-DE.md
docs/environment-wsl-certificate-authority-EN.md
docs/environment-wsl-certificate-authority-EL.md
docs/operations-certificate-authority-DE.md
docs/operations-certificate-authority-EN.md
docs/operations-certificate-authority-EL.md
docs/security-certificate-authority-DE.md
docs/security-certificate-authority-EN.md
docs/security-certificate-authority-EL.md
docs/troubleshooting-certificate-authority-DE.md
docs/troubleshooting-certificate-authority-EN.md
docs/troubleshooting-certificate-authority-EL.md
Workshop levels12
workshops/01-fundamentals-certificate-authority-DE.md
workshops/01-fundamentals-certificate-authority-EN.md
workshops/01-fundamentals-certificate-authority-EL.md
workshops/02-intermediate-certificate-authority-DE.md
workshops/02-intermediate-certificate-authority-EN.md
workshops/02-intermediate-certificate-authority-EL.md
workshops/03-professional-certificate-authority-DE.md
workshops/03-professional-certificate-authority-EN.md
workshops/03-professional-certificate-authority-EL.md
workshops/04-advanced-security-certificate-authority-DE.md
workshops/04-advanced-security-certificate-authority-EN.md
workshops/04-advanced-security-certificate-authority-EL.md
Exercises12
exercises/01-fundamentals-exercises-certificate-authority-DE.md
exercises/01-fundamentals-exercises-certificate-authority-EN.md
exercises/01-fundamentals-exercises-certificate-authority-EL.md
exercises/02-intermediate-exercises-certificate-authority-DE.md
exercises/02-intermediate-exercises-certificate-authority-EN.md
exercises/02-intermediate-exercises-certificate-authority-EL.md
exercises/03-professional-exercises-certificate-authority-DE.md
exercises/03-professional-exercises-certificate-authority-EN.md
exercises/03-professional-exercises-certificate-authority-EL.md
exercises/04-advanced-security-exercises-certificate-authority-DE.md
exercises/04-advanced-security-exercises-certificate-authority-EN.md
exercises/04-advanced-security-exercises-certificate-authority-EL.md
Assessments & solutions27
assessments/01-fundamentals-certificate-authority-assessment-DE.md
assessments/01-fundamentals-certificate-authority-assessment-EN.md
assessments/01-fundamentals-certificate-authority-assessment-EL.md
assessments/01-fundamentals-certificate-authority-solution-DE.md
assessments/01-fundamentals-certificate-authority-solution-EN.md
assessments/01-fundamentals-certificate-authority-solution-EL.md
assessments/02-intermediate-certificate-authority-assessment-DE.md
assessments/02-intermediate-certificate-authority-assessment-EN.md
assessments/02-intermediate-certificate-authority-assessment-EL.md
assessments/02-intermediate-certificate-authority-solution-DE.md
assessments/02-intermediate-certificate-authority-solution-EN.md
assessments/02-intermediate-certificate-authority-solution-EL.md
assessments/03-professional-certificate-authority-assessment-DE.md
assessments/03-professional-certificate-authority-assessment-EN.md
assessments/03-professional-certificate-authority-assessment-EL.md
assessments/03-professional-certificate-authority-solution-DE.md
assessments/03-professional-certificate-authority-solution-EN.md
assessments/03-professional-certificate-authority-solution-EL.md
assessments/04-advanced-security-certificate-authority-assessment-DE.md
assessments/04-advanced-security-certificate-authority-assessment-EN.md
assessments/04-advanced-security-certificate-authority-assessment-EL.md
assessments/04-advanced-security-certificate-authority-solution-DE.md
assessments/04-advanced-security-certificate-authority-solution-EN.md
assessments/04-advanced-security-certificate-authority-solution-EL.md
assessments/05-official-certificates-certificate-authority-DE.md
assessments/05-official-certificates-certificate-authority-EN.md
assessments/05-official-certificates-certificate-authority-EL.md
Practice modules400
examples/00-lab-skeleton
examples/00-lab-skeleton/docs
examples/00-lab-skeleton/docs/de
examples/00-lab-skeleton/docs/en
examples/00-lab-skeleton/openssl
examples/01-inspect-certificates
examples/01-inspect-certificates/docs
examples/01-inspect-certificates/docs/de
examples/01-inspect-certificates/docs/en
examples/01-inspect-certificates/openssl
examples/02-root-ca
examples/02-root-ca/docs
examples/02-root-ca/docs/de
examples/02-root-ca/docs/en
examples/02-root-ca/openssl
examples/03-intermediate-ca
examples/03-intermediate-ca/docs
examples/03-intermediate-ca/docs/de
examples/03-intermediate-ca/docs/en
examples/03-intermediate-ca/openssl
examples/04-server-csr
examples/04-server-csr/docs
examples/04-server-csr/docs/de
examples/04-server-csr/docs/en
examples/04-server-csr/openssl
examples/05-sign-server-cert
examples/05-sign-server-cert/docs
examples/05-sign-server-cert/docs/de
examples/05-sign-server-cert/docs/en
examples/05-sign-server-cert/openssl
examples/06-chain-verify
examples/06-chain-verify/docs
examples/06-chain-verify/docs/de
examples/06-chain-verify/docs/en
examples/06-chain-verify/openssl
examples/07-san-certificate
examples/07-san-certificate/docs
examples/07-san-certificate/docs/de
examples/07-san-certificate/docs/en
examples/07-san-certificate/openssl
examples/08-client-certificate
examples/08-client-certificate/docs
examples/08-client-certificate/docs/de
examples/08-client-certificate/docs/en
examples/08-client-certificate/openssl
examples/09-mtls-nginx-model
examples/09-mtls-nginx-model/docs
examples/09-mtls-nginx-model/docs/de
examples/09-mtls-nginx-model/docs/en
examples/09-mtls-nginx-model/nginx
examples/09-mtls-nginx-model/openssl
examples/10-crl-generation
examples/10-crl-generation/docs
examples/10-crl-generation/docs/de
examples/10-crl-generation/docs/en
examples/10-crl-generation/openssl
examples/11-revoke-certificate
examples/11-revoke-certificate/docs
examples/11-revoke-certificate/docs/de
examples/11-revoke-certificate/docs/en
examples/11-revoke-certificate/openssl
examples/12-ocsp-response-model
examples/12-ocsp-response-model/docs
examples/12-ocsp-response-model/docs/de
examples/12-ocsp-response-model/docs/en
examples/12-ocsp-response-model/openssl
examples/13-key-algorithms
examples/13-key-algorithms/docs
examples/13-key-algorithms/docs/de
examples/13-key-algorithms/docs/en
examples/14-certificate-extensions
examples/14-certificate-extensions/docs
examples/14-certificate-extensions/docs/de
examples/14-certificate-extensions/docs/en
examples/14-certificate-extensions/openssl
examples/15-name-constraints-lab
examples/15-name-constraints-lab/docs
examples/15-name-constraints-lab/docs/de
examples/15-name-constraints-lab/docs/en
examples/15-name-constraints-lab/openssl
examples/16-pathlen-basicconstraints
examples/16-pathlen-basicconstraints/docs
examples/16-pathlen-basicconstraints/docs/de
examples/16-pathlen-basicconstraints/docs/en
examples/16-pathlen-basicconstraints/openssl
examples/17-trust-store-model
examples/17-trust-store-model/docs
examples/17-trust-store-model/docs/de
examples/17-trust-store-model/docs/en
examples/17-trust-store-model/openssl
examples/18-renewal-rotation
examples/18-renewal-rotation/docs
examples/18-renewal-rotation/docs/de
examples/18-renewal-rotation/docs/en
examples/18-renewal-rotation/openssl
examples/19-expiry-monitoring
examples/19-expiry-monitoring/docs
examples/19-expiry-monitoring/docs/de
examples/19-expiry-monitoring/docs/en
examples/19-expiry-monitoring/openssl
examples/20-acme-flow-model
examples/20-acme-flow-model/acme
examples/20-acme-flow-model/docs
examples/20-acme-flow-model/docs/de
examples/20-acme-flow-model/docs/en
examples/21-certbot-model
examples/21-certbot-model/certbot
examples/21-certbot-model/docs
examples/21-certbot-model/docs/de
examples/21-certbot-model/docs/en
examples/21-certbot-model/nginx
examples/22-vault-pki-model
examples/22-vault-pki-model/docs
examples/22-vault-pki-model/docs/de
examples/22-vault-pki-model/docs/en
examples/22-vault-pki-model/vault
examples/23-cert-manager-model
examples/23-cert-manager-model/cert-manager
examples/23-cert-manager-model/docs
examples/23-cert-manager-model/docs/de
examples/23-cert-manager-model/docs/en
examples/24-step-ca-model
examples/24-step-ca-model/docs
examples/24-step-ca-model/docs/de
examples/24-step-ca-model/docs/en
examples/24-step-ca-model/step-ca
examples/25-spiffe-spire-model
examples/25-spiffe-spire-model/docs
examples/25-spiffe-spire-model/docs/de
examples/25-spiffe-spire-model/docs/en
examples/25-spiffe-spire-model/spiffe
examples/26-hsm-offline-root-model
examples/26-hsm-offline-root-model/docs
examples/26-hsm-offline-root-model/docs/de
examples/26-hsm-offline-root-model/docs/en
examples/26-hsm-offline-root-model/hsm
examples/27-policy-cps-template
examples/27-policy-cps-template/docs
examples/27-policy-cps-template/docs/de
examples/27-policy-cps-template/docs/en
examples/27-policy-cps-template/policy
examples/28-audit-log-model
examples/28-audit-log-model/audit
examples/28-audit-log-model/docs
examples/28-audit-log-model/docs/de
examples/28-audit-log-model/docs/en
examples/29-incident-response-revocation
examples/29-incident-response-revocation/docs
examples/29-incident-response-revocation/docs/de
examples/29-incident-response-revocation/docs/en
examples/29-incident-response-revocation/incident
examples/29-incident-response-revocation/openssl
examples/30-troubleshooting-chain
examples/30-troubleshooting-chain/docs
examples/30-troubleshooting-chain/docs/de
examples/30-troubleshooting-chain/docs/en
examples/30-troubleshooting-chain/openssl
examples/.gitignore
examples/00-lab-skeleton/README.md
examples/00-lab-skeleton/docs/de/README.md
examples/00-lab-skeleton/docs/en/README.md
examples/00-lab-skeleton/docs/el/README.md
examples/00-lab-skeleton/openssl/intermediate-ca.cnf
examples/00-lab-skeleton/openssl/root-ca.cnf
examples/00-lab-skeleton/openssl/server.cnf
examples/00-lab-skeleton/run.sh
examples/01-inspect-certificates/README.md
examples/01-inspect-certificates/docs/de/README.md
examples/01-inspect-certificates/docs/en/README.md
examples/01-inspect-certificates/docs/el/README.md
examples/01-inspect-certificates/openssl/intermediate-ca.cnf
examples/01-inspect-certificates/openssl/root-ca.cnf
examples/01-inspect-certificates/openssl/server.cnf
examples/01-inspect-certificates/run.sh
examples/02-root-ca/README.md
examples/02-root-ca/docs/de/README.md
examples/02-root-ca/docs/en/README.md
examples/02-root-ca/docs/el/README.md
examples/02-root-ca/openssl/intermediate-ca.cnf
examples/02-root-ca/openssl/root-ca.cnf
examples/02-root-ca/openssl/server.cnf
examples/02-root-ca/run.sh
examples/03-intermediate-ca/README.md
examples/03-intermediate-ca/docs/de/README.md
examples/03-intermediate-ca/docs/en/README.md
examples/03-intermediate-ca/docs/el/README.md
examples/03-intermediate-ca/openssl/intermediate-ca.cnf
examples/03-intermediate-ca/openssl/root-ca.cnf
examples/03-intermediate-ca/openssl/server.cnf
examples/03-intermediate-ca/run.sh
examples/04-server-csr/README.md
examples/04-server-csr/docs/de/README.md
examples/04-server-csr/docs/en/README.md
examples/04-server-csr/docs/el/README.md
examples/04-server-csr/openssl/intermediate-ca.cnf
examples/04-server-csr/openssl/root-ca.cnf
examples/04-server-csr/openssl/server.cnf
examples/04-server-csr/run.sh
examples/05-sign-server-cert/README.md
examples/05-sign-server-cert/docs/de/README.md
examples/05-sign-server-cert/docs/en/README.md
examples/05-sign-server-cert/docs/el/README.md
examples/05-sign-server-cert/openssl/intermediate-ca.cnf
examples/05-sign-server-cert/openssl/root-ca.cnf
examples/05-sign-server-cert/openssl/server.cnf
examples/05-sign-server-cert/run.sh
examples/06-chain-verify/README.md
examples/06-chain-verify/docs/de/README.md
examples/06-chain-verify/docs/en/README.md
examples/06-chain-verify/docs/el/README.md
examples/06-chain-verify/openssl/intermediate-ca.cnf
examples/06-chain-verify/openssl/root-ca.cnf
examples/06-chain-verify/openssl/server.cnf
examples/06-chain-verify/run.sh
examples/07-san-certificate/README.md
examples/07-san-certificate/docs/de/README.md
examples/07-san-certificate/docs/en/README.md
examples/07-san-certificate/docs/el/README.md
examples/07-san-certificate/openssl/intermediate-ca.cnf
examples/07-san-certificate/openssl/root-ca.cnf
examples/07-san-certificate/openssl/server.cnf
examples/07-san-certificate/run.sh
examples/08-client-certificate/README.md
examples/08-client-certificate/docs/de/README.md
examples/08-client-certificate/docs/en/README.md
examples/08-client-certificate/docs/el/README.md
examples/08-client-certificate/openssl/client.cnf
examples/08-client-certificate/openssl/intermediate-ca.cnf
examples/08-client-certificate/openssl/root-ca.cnf
examples/08-client-certificate/openssl/server.cnf
examples/08-client-certificate/run.sh
examples/09-mtls-nginx-model/README.md
examples/09-mtls-nginx-model/docs/de/README.md
examples/09-mtls-nginx-model/docs/en/README.md
examples/09-mtls-nginx-model/docs/el/README.md
examples/09-mtls-nginx-model/nginx/mtls-server.conf
examples/09-mtls-nginx-model/openssl/client.cnf
examples/09-mtls-nginx-model/openssl/intermediate-ca.cnf
examples/09-mtls-nginx-model/openssl/root-ca.cnf
examples/09-mtls-nginx-model/openssl/server.cnf
examples/09-mtls-nginx-model/run.sh
examples/10-crl-generation/README.md
examples/10-crl-generation/docs/de/README.md
examples/10-crl-generation/docs/en/README.md
examples/10-crl-generation/docs/el/README.md
examples/10-crl-generation/openssl/ca-database.cnf
examples/10-crl-generation/openssl/intermediate-ca.cnf
examples/10-crl-generation/openssl/root-ca.cnf
examples/10-crl-generation/openssl/server.cnf
examples/10-crl-generation/run.sh
examples/11-revoke-certificate/README.md
examples/11-revoke-certificate/docs/de/README.md
examples/11-revoke-certificate/docs/en/README.md
examples/11-revoke-certificate/docs/el/README.md
examples/11-revoke-certificate/openssl/ca-database.cnf
examples/11-revoke-certificate/openssl/intermediate-ca.cnf
examples/11-revoke-certificate/openssl/root-ca.cnf
examples/11-revoke-certificate/openssl/server.cnf
examples/11-revoke-certificate/run.sh
examples/12-ocsp-response-model/README.md
examples/12-ocsp-response-model/docs/de/README.md
examples/12-ocsp-response-model/docs/en/README.md
examples/12-ocsp-response-model/docs/el/README.md
examples/12-ocsp-response-model/openssl/ca-database.cnf
examples/12-ocsp-response-model/openssl/intermediate-ca.cnf
examples/12-ocsp-response-model/openssl/root-ca.cnf
examples/12-ocsp-response-model/openssl/server.cnf
examples/12-ocsp-response-model/run.sh
examples/13-key-algorithms/README.md
examples/13-key-algorithms/docs/de/README.md
examples/13-key-algorithms/docs/en/README.md
examples/13-key-algorithms/docs/el/README.md
examples/13-key-algorithms/run.sh
examples/14-certificate-extensions/README.md
examples/14-certificate-extensions/docs/de/README.md
examples/14-certificate-extensions/docs/en/README.md
examples/14-certificate-extensions/docs/el/README.md
examples/14-certificate-extensions/openssl/intermediate-ca.cnf
examples/14-certificate-extensions/openssl/root-ca.cnf
examples/14-certificate-extensions/openssl/server.cnf
examples/14-certificate-extensions/run.sh
examples/15-name-constraints-lab/README.md
examples/15-name-constraints-lab/docs/de/README.md
examples/15-name-constraints-lab/docs/en/README.md
examples/15-name-constraints-lab/docs/el/README.md
examples/15-name-constraints-lab/openssl/intermediate-ca.cnf
examples/15-name-constraints-lab/openssl/root-ca.cnf
examples/15-name-constraints-lab/openssl/server.cnf
examples/15-name-constraints-lab/run.sh
examples/16-pathlen-basicconstraints/README.md
examples/16-pathlen-basicconstraints/docs/de/README.md
examples/16-pathlen-basicconstraints/docs/en/README.md
examples/16-pathlen-basicconstraints/docs/el/README.md
examples/16-pathlen-basicconstraints/openssl/intermediate-ca.cnf
examples/16-pathlen-basicconstraints/openssl/root-ca.cnf
examples/16-pathlen-basicconstraints/openssl/server.cnf
examples/16-pathlen-basicconstraints/run.sh
examples/17-trust-store-model/README.md
examples/17-trust-store-model/docs/de/README.md
examples/17-trust-store-model/docs/en/README.md
examples/17-trust-store-model/docs/el/README.md
examples/17-trust-store-model/openssl/intermediate-ca.cnf
examples/17-trust-store-model/openssl/root-ca.cnf
examples/17-trust-store-model/openssl/server.cnf
examples/17-trust-store-model/run.sh
examples/18-renewal-rotation/README.md
examples/18-renewal-rotation/docs/de/README.md
examples/18-renewal-rotation/docs/en/README.md
examples/18-renewal-rotation/docs/el/README.md
examples/18-renewal-rotation/openssl/intermediate-ca.cnf
examples/18-renewal-rotation/openssl/root-ca.cnf
examples/18-renewal-rotation/openssl/server.cnf
examples/18-renewal-rotation/run.sh
examples/19-expiry-monitoring/README.md
examples/19-expiry-monitoring/docs/de/README.md
examples/19-expiry-monitoring/docs/en/README.md
examples/19-expiry-monitoring/docs/el/README.md
examples/19-expiry-monitoring/openssl/intermediate-ca.cnf
examples/19-expiry-monitoring/openssl/root-ca.cnf
examples/19-expiry-monitoring/openssl/server.cnf
examples/19-expiry-monitoring/run.sh
examples/20-acme-flow-model/README.md
examples/20-acme-flow-model/acme/acme-flow.yml
examples/20-acme-flow-model/docs/de/README.md
examples/20-acme-flow-model/docs/en/README.md
examples/20-acme-flow-model/docs/el/README.md
examples/20-acme-flow-model/run.sh
examples/21-certbot-model/README.md
examples/21-certbot-model/certbot/renewal-example.conf
examples/21-certbot-model/docs/de/README.md
examples/21-certbot-model/docs/en/README.md
examples/21-certbot-model/docs/el/README.md
examples/21-certbot-model/nginx/example-http01.conf
examples/21-certbot-model/run.sh
examples/22-vault-pki-model/README.md
examples/22-vault-pki-model/docs/de/README.md
examples/22-vault-pki-model/docs/en/README.md
examples/22-vault-pki-model/docs/el/README.md
examples/22-vault-pki-model/run.sh
examples/22-vault-pki-model/vault/pki-commands.sh
examples/22-vault-pki-model/vault/pki-policy.hcl
examples/23-cert-manager-model/README.md
examples/23-cert-manager-model/cert-manager/certificate.yaml
examples/23-cert-manager-model/cert-manager/issuer.yaml
examples/23-cert-manager-model/docs/de/README.md
examples/23-cert-manager-model/docs/en/README.md
examples/23-cert-manager-model/docs/el/README.md
examples/23-cert-manager-model/run.sh
examples/24-step-ca-model/README.md
examples/24-step-ca-model/docs/de/README.md
examples/24-step-ca-model/docs/en/README.md
examples/24-step-ca-model/docs/el/README.md
examples/24-step-ca-model/run.sh
examples/24-step-ca-model/step-ca/ca.json
examples/25-spiffe-spire-model/README.md
examples/25-spiffe-spire-model/docs/de/README.md
examples/25-spiffe-spire-model/docs/en/README.md
examples/25-spiffe-spire-model/docs/el/README.md
examples/25-spiffe-spire-model/run.sh
examples/25-spiffe-spire-model/spiffe/registration-entry.json
examples/25-spiffe-spire-model/spiffe/spire-server.conf
examples/26-hsm-offline-root-model/README.md
examples/26-hsm-offline-root-model/docs/de/README.md
examples/26-hsm-offline-root-model/docs/en/README.md
examples/26-hsm-offline-root-model/docs/el/README.md
examples/26-hsm-offline-root-model/hsm/offline-root-ceremony.md
examples/26-hsm-offline-root-model/hsm/pkcs11-openssl.cnf
examples/26-hsm-offline-root-model/run.sh
examples/27-policy-cps-template/README.md
examples/27-policy-cps-template/docs/de/README.md
examples/27-policy-cps-template/docs/en/README.md
examples/27-policy-cps-template/docs/el/README.md
examples/27-policy-cps-template/policy/cp-cps-template.md
examples/27-policy-cps-template/run.sh
examples/28-audit-log-model/README.md
examples/28-audit-log-model/audit/audit-events.jsonl
examples/28-audit-log-model/audit/evidence-checklist.md
examples/28-audit-log-model/docs/de/README.md
examples/28-audit-log-model/docs/en/README.md
examples/28-audit-log-model/docs/el/README.md
examples/28-audit-log-model/run.sh
examples/29-incident-response-revocation/README.md
examples/29-incident-response-revocation/docs/de/README.md
examples/29-incident-response-revocation/docs/en/README.md
examples/29-incident-response-revocation/docs/el/README.md
examples/29-incident-response-revocation/incident/revocation-runbook.md
examples/29-incident-response-revocation/openssl/ca-database.cnf
examples/29-incident-response-revocation/openssl/intermediate-ca.cnf
examples/29-incident-response-revocation/openssl/root-ca.cnf
examples/29-incident-response-revocation/openssl/server.cnf
examples/29-incident-response-revocation/run.sh
examples/30-troubleshooting-chain/README.md
examples/30-troubleshooting-chain/docs/de/README.md
examples/30-troubleshooting-chain/docs/en/README.md
examples/30-troubleshooting-chain/docs/el/README.md
examples/30-troubleshooting-chain/openssl/intermediate-ca.cnf
examples/30-troubleshooting-chain/openssl/root-ca.cnf
examples/30-troubleshooting-chain/openssl/server.cnf
examples/30-troubleshooting-chain/run.sh
examples/README.md
Setup & helper scripts1
scripts/provision_certificate_authority.sh

Orthevs Academy

Back to the Academy
ANSAutomation

Ansible

From agentless automation and inventories through playbooks, roles and collections to Vault, CI checks, controlled rollouts and operational evidence.

Open detail page ↗
CTRContainer runtime

containerd

Runtime architecture, OCI and CRI, content store, snapshotters, registry integration, Kubernetes nodes, rootless operation, hardening and incident response.

Open detail page ↗
DNSNetwork services

DNS

Namespace and resolution, authoritative servers and resolvers, delegation, caching, DNSSEC, encrypted DNS models, CoreDNS, monitoring and incident analysis.

Open detail page ↗

PKI · Orthevs Academy

Frame the workshop application together.

For internal training, learning paths or technical deep dives, scope, sequence and audience can be aligned with the intended context.

Contact the Academy

Orthevs as an app

Install Orthevs

The Orthevs web app can be installed on supported mobile devices and desktop browsers.

iPhone and iPad

Open Orthevs in Safari. Tap Share, then Add to Home Screen. Enable Open as Web App if offered, then tap Add.

Android

For the web app, open the browser menu and choose Install app or Add to Home screen. Confirm the installation.

Desktop browser

Open the browser menu or the install icon in the address bar, then choose Install app or Add to Dock.

Web app installation depends on your browser. If no install prompt appears, follow the browser steps shown above.