Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Workshop wiki · PKI
Certificate Authority
Complete, versioned learning material for this workshop—from reference documentation and workshop levels to exercises, assessments and the supporting texts for every practice module.
Certificate Authority
My learning progress
With the web app option enabled, your progress is stored on this device.
Learning progress in the web app
Mark chapters as read, view reading progress and check off practice modules after enabling the optional web app. Workshop progress is calculated from chapters across all document pages. Your choices stay on this device; there is no account or server sync. Installation is not required. Withdrawing your choice in Privacy settings deletes the progress.
Workshop progress0%
Practice modules completed0 / 31
Documents read0 / 98
Workshop progress0%
0 / 1162 chapters readCompleted
Practice modules
Workshop examples as ZIP files
All 31 practice examples in this workshop are available as individual ZIP files. Choose an example to download its package directly.
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 8
README.mddocs/de/README.mddocs/en/README.mdopenssl/client.cnfopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 9
README.mddocs/de/README.mddocs/en/README.mdnginx/mtls-server.confopenssl/client.cnfopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 8
README.mddocs/de/README.mddocs/en/README.mdopenssl/ca-database.cnfopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 8
README.mddocs/de/README.mddocs/en/README.mdopenssl/ca-database.cnfopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 8
README.mddocs/de/README.mddocs/en/README.mdopenssl/ca-database.cnfopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 4
README.mddocs/de/README.mddocs/en/README.mdrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 5
README.mdacme/acme-flow.ymldocs/de/README.mddocs/en/README.mdrun.sh
Files in the ZIP · 6
README.mdcertbot/renewal-example.confdocs/de/README.mddocs/en/README.mdnginx/example-http01.confrun.sh
Files in the ZIP · 6
README.mddocs/de/README.mddocs/en/README.mdrun.shvault/pki-commands.shvault/pki-policy.hcl
Files in the ZIP · 6
README.mdcert-manager/certificate.yamlcert-manager/issuer.yamldocs/de/README.mddocs/en/README.mdrun.sh
Files in the ZIP · 5
README.mddocs/de/README.mddocs/en/README.mdrun.shstep-ca/ca.json
Files in the ZIP · 6
README.mddocs/de/README.mddocs/en/README.mdrun.shspiffe/registration-entry.jsonspiffe/spire-server.conf
Files in the ZIP · 6
README.mddocs/de/README.mddocs/en/README.mdhsm/offline-root-ceremony.mdhsm/pkcs11-openssl.cnfrun.sh
Files in the ZIP · 5
README.mddocs/de/README.mddocs/en/README.mdpolicy/cp-cps-template.mdrun.sh
Files in the ZIP · 6
README.mdaudit/audit-events.jsonlaudit/evidence-checklist.mddocs/de/README.mddocs/en/README.mdrun.sh
Files in the ZIP · 9
README.mddocs/de/README.mddocs/en/README.mdincident/revocation-runbook.mdopenssl/ca-database.cnfopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Files in the ZIP · 7
README.mddocs/de/README.mddocs/en/README.mdopenssl/intermediate-ca.cnfopenssl/root-ca.cnfopenssl/server.cnfrun.sh
Learning material
Documentation in the Orthevs Wiki
The material retains its subject-specific structure. German and English versions are cross-linked, and diagrams are generated directly from the included Mermaid sources.
Workshop overview
1Technical documentation
13
English · 64.5 KB
Architecture: Certificate Authority
PKI Trust Model is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 67.2 KBBest Practices: Certificate Authority
PKI Design is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 72.3 KBCommand Reference: Certificate Authority
OpenSSL Ground Rules is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 64.3 KBConcepts: Certificate Authority
X.509 is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 75.2 KBCurriculum: Certificate Authority
Curriculum Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 51.6 KBDiagrams: Certificate Authority
Overall Architecture is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 51.5 KBRemote and Cloud Environments: Certificate Authority
Purpose is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 49.2 KBUbuntu on Bare Metal: Certificate Authority
Purpose is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 51.4 KBUbuntu in a VM: Certificate Authority
Purpose is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 51.4 KBUbuntu on WSL: Certificate Authority
Purpose is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 62.2 KBOperations: Certificate Authority
Operating Model is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 64.4 KBSecurity: Certificate Authority
Threat Model is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 70.1 KBTroubleshooting: Certificate Authority
Diagnostic Sequence is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗ReadWorkshop levels
4
English · 77.6 KB
Certificate Authority Workshop: Fundamentals (EN)
!Certificate Authority Fundamentals
Open document ↗Read English · 77.7 KBCertificate Authority Workshop: Intermediate (EN)
!Certificate Authority Intermediate
Open document ↗Read English · 77.7 KBCertificate Authority Workshop: Professional (EN)
!Certificate Authority Professional
Open document ↗Read English · 77.8 KBCertificate Authority Workshop: Advanced + Security (EN)
!Certificate Authority Advanced + Security
Open document ↗ReadExercises
4
English · 68.8 KB
Certificate Authority Workshop: Fundamentals – Exercises with Solutions
Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 68.9 KBCertificate Authority Workshop: Intermediate – Exercises with Solutions
Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 68.9 KBCertificate Authority Workshop: Professional – Exercises with Solutions
Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 69.1 KBCertificate Authority Workshop: Advanced + Security – Exercises with Solutions
Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗ReadAssessments and solutions
9
English · 76.5 KB
CA Assessment: 01 Fundamentals
Assessment Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 93.9 KBModel Solution: CA Assessment 01 – Fundamentals
Usage Notes is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 76.6 KBCA Assessment: 02 Intermediate
Assessment Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 94.1 KBModel Solution: CA Assessment 02 – Intermediate
Usage Notes is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 76.6 KBCA Assessment: 03 Professional
Assessment Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 94.1 KBModel Solution: CA Assessment 03 – Professional
Usage Notes is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 76.8 KBCA Assessment: 04 Advanced + Security
Assessment Goal is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 94.3 KBModel Solution: CA Assessment 04 – Advanced + Security
Usage Notes is treated as a reviewable PKI building block. The important point is not merely that a command creates a certificate, but that purpose, extensions, trust chain, validity, key usage, and cleanup are understandable.
Open document ↗Read English · 24.2 KBOfficial Certificates and Standards: Certificate Authority
This document does not invent a certification. There is no single universal vendor-neutral credential that replaces the whole CA workshop. The relevant anchors are standards, policies, audits, and role-specific security certifications.
Open document ↗ReadPractice modules
31 modules as one continuous learning path.
The sequence remains unchanged: from the lab skeleton through technical foundations and operating models to final troubleshooting. The technical directory names are deliberately preserved.
00 lab-skeleton
2
German and English · 8.9 KB
00 Lab-Struktur und PKI-Arbeitsmodell
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Lab structure and PKI working model
A clean working structure for local CA labs with separate areas for configuration, keys, certificates, CSRs, evidence and cleanup.
Open document ↗Read01 inspect-certificates
2
German and English · 8.9 KB
01 Zertifikate inspizieren
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Inspect certificates
Existing certificates are inspected with OpenSSL, their fields are explained and checked against concrete review questions.
Open document ↗Read02 root-ca
2
German and English · 8.8 KB
02 Root-CA erzeugen
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Create a root CA
A private root CA is created locally, correctly marked as a CA and treated as a trust anchor.
Open document ↗Read03 intermediate-ca
2
German and English · 8.9 KB
03 Intermediate-CA signieren
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Sign an intermediate CA
A root CA signs an intermediate CA with basic constraints and a path length constraint.
Open document ↗Read04 server-csr
2
German and English · 8.9 KB
04 Server-CSR mit SAN erzeugen
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Create a server CSR with SAN
A server key and CSR are created with subject alternative names and reviewed before signing.
Open document ↗Read05 sign-server-cert
2
German and English · 8.9 KB
05 Serverzertifikat signieren
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Sign a server certificate
The intermediate CA signs an end-entity server certificate with correct extensions.
Open document ↗Read06 chain-verify
2
German and English · 8.9 KB
06 Zertifikatskette prüfen
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Verify a certificate chain
Root, intermediate and leaf are verified as a chain, including the failure mode when the intermediate is missing.
Open document ↗Read07 san-certificate
2
German and English · 8.9 KB
07 SAN-Zertifikat prüfen
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Check a SAN certificate
DNS and IP SANs are traced in the CSR and certificate; the common name is not mistaken for hostname validation.
Open document ↗Read08 client-certificate
2
German and English · 8.9 KB
08 Clientzertifikat ausstellen
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Issue a client certificate
A client certificate suitable for mTLS is created with the clientAuth extended key usage and verified.
Open document ↗Read09 mtls-nginx-model
2
German and English · 8.9 KB
09 mTLS mit NGINX modellieren
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Model mTLS with NGINX
A local PKI creates server and client certificates; the NGINX configuration shows the mTLS verification points.
Open document ↗Read10 crl-generation
2
German and English · 8.9 KB
10 CRL erzeugen
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.6 KBExample Documentation: Generate a CRL
An intermediate CA maintains a CA database and publishes a certificate revocation list.
Open document ↗Read11 revoke-certificate
2
German and English · 8.9 KB
11 Zertifikat widerrufen
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Revoke a certificate
An issued certificate is revoked, the CRL is regenerated and revocation evidence is collected.
Open document ↗Read12 ocsp-response-model
2
German and English · 8.9 KB
12 OCSP-Antwort modellieren
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Model an OCSP response
OCSP-relevant AIA extensions, the CA database and an offline responder model are made reviewable.
Open document ↗Read13 key-algorithms
2
German and English · 8.8 KB
13 Schlüsselalgorithmen vergleichen
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Compare key algorithms
RSA, ECDSA and Ed25519 are created locally and compared with their usage boundaries.
Open document ↗Read14 certificate-extensions
2
German and English · 8.9 KB
14 X.509-Extensions bewerten
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Evaluate X.509 extensions
Basic constraints, key usage, extended key usage, SKI, AKI and SAN are extracted from certificates.
Open document ↗Read15 name-constraints-lab
2
German and English · 8.9 KB
15 Name Constraints testen
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Test name constraints
An intermediate CA constrains allowed DNS names and verification shows accepted and rejected names.
Open document ↗Read16 pathlen-basicconstraints
2
German and English · 8.9 KB
16 Path Length und Basic Constraints
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Path length and basic constraints
An intermediate with pathlen:0 must not create another subordinate CA; the failure is made visible in a controlled way.
Open document ↗Read17 trust-store-model
2
German and English · 8.9 KB
17 Trust Store modellieren
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Model a trust store
The example shows the difference between a certificate chain, a trust anchor and a local trust store.
Open document ↗Read18 renewal-rotation
2
German and English · 8.9 KB
18 Erneuerung und Rotation
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Renewal and rotation
An expiring server certificate is replaced by a new certificate; key reuse and a new serial number are evaluated.
Open document ↗Read19 expiry-monitoring
2
German and English · 8.9 KB
19 Ablaufüberwachung
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.6 KBExample Documentation: Expiry monitoring
OpenSSL -checkend is used to move certificates into a renewal process before expiry.
Open document ↗Read20 acme-flow-model
2
German and English · 8.8 KB
20 ACME-Fluss modellieren
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Model the ACME flow
Account, order, authorization, challenge, finalize and certificate are documented as a reviewable ACME flow.
Open document ↗Read21 certbot-model
2
German and English · 8.9 KB
21 Certbot- und Webserver-Modell
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Certbot and web server model
A Certbot renewal model shows webroot, certificate path, deploy hook and NGINX reference without production domains.
Open document ↗Read22 vault-pki-model
2
German and English · 8.8 KB
22 Vault-PKI-Modell
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Vault PKI model
Vault PKI roles, TTLs, issuer chains and policies are described as a reviewable operating model.
Open document ↗Read23 cert-manager-model
2
German and English · 8.8 KB
23 cert-manager-Modell
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.6 KBExample Documentation: cert-manager model
Issuer, certificate and secret references are modeled as Kubernetes PKI automation.
Open document ↗Read24 step-ca-model
2
German and English · 8.8 KB
24 Smallstep-CA-Modell
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Smallstep CA model
A Smallstep configuration model shows provisioners, claims, root, intermediate and host certificates.
Open document ↗Read25 spiffe-spire-model
2
German and English · 8.9 KB
25 SPIFFE-SPIRE-Modell
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: SPIFFE SPIRE model
Workload identities with SPIFFE IDs, trust domains and registration entries are related to X.509 SVIDs.
Open document ↗Read26 hsm-offline-root-model
3
German and English · 8.9 KB
26 Offline Root und HSM-Modell
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Offline root and HSM model
Root key ceremony, PKCS#11 configuration and separation of root and issuing CA are modeled.
Open document ↗Read German and English · 451 BOffline Root Ceremony
1. Teilnehmer, Rollen und Zwei-Personen-Prinzip dokumentieren. 2. HSM oder Token initialisieren und Seriennummer erfassen. 3. Root-Key im geschützten Gerät erzeugen, nicht exportieren. 4. Root-Zertifikat mit CA:TRUE und Path Length begre…
Open document ↗Read27 policy-cps-template
3
German and English · 8.8 KB
27 CP/CPS-Vorlage
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: CP/CPS template
Certificate policy and certification practice statement are set up as a reviewable documentation structure.
Open document ↗Read German and English · 769 BCertificate Policy / Certification Practice Statement Template
Diese Vorlage beschreibt eine private Workshop-PKI, keine öffentlich vertrauenswürdige CA.
Open document ↗Read28 audit-log-model
3
German and English · 8.8 KB
28 Audit-Log-Modell
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read German and English · 233 BAudit Evidence Checklist
Open document ↗Read English · 8.6 KBExample Documentation: Audit log model
Issuance, revocation, CRL generation and private key access are modeled as audit events.
Open document ↗Read29 incident-response-revocation
3
German and English · 9.0 KB
29 Incident Response und Widerruf
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Incident response and revocation
A compromised certificate is revoked, a replacement is issued and the communication trail is documented.
Open document ↗Read German and English · 343 BRevocation Runbook
1. Meldung aufnehmen und betroffene Seriennummer bestätigen. 2. Zertifikat in der CA-Datenbank widerrufen. 3. Neue CRL erzeugen und veröffentlichen. 4. Ersatz-Zertifikat über neuen CSR ausstellen. 5. Betreiber, Security und Relying Parti…
Open document ↗Read30 troubleshooting-chain
2
German and English · 8.9 KB
30 Chain-Troubleshooting
Dieses Beispiel ist Teil des Certificate-Authority-Workshops und folgt derselben Grundstruktur wie die Kubernetes-Beispiele: ein knappes Haupt-README, vertiefende Dokumentation in Deutsch und Englisch sowie kleine, prüfbare Artefakte.
Open document ↗Read English · 8.7 KBExample Documentation: Chain troubleshooting
Typical chain failures are reproduced: missing intermediate, wrong trust anchor and wrong hostname.
Open document ↗ReadPKI · Orthevs Academy
31 modules as one continuous learning path.
The sequence remains unchanged: from the lab skeleton through technical foundations and operating models to final troubleshooting. The technical directory names are deliberately preserved.