Format

• written questions
• practical OpenSSL task
• review of a risky TLS scenario
• short operations and security assessment

Notes

Work without production keys. Document assumptions. If external scans are not allowed, use local OpenSSL artifacts and static review rules.

Questions

Question 01

Explain how you distinguish TLS from SSL and plaintext protocols. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 02

Explain how you differentiate TLS 1.2 and TLS 1.3. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 03

Explain how you analyze X.509 certificates. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 04

Explain how you protect private keys. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 05

Explain how you create CSR and SAN correctly. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 06

Explain how you verify certificate chains. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 07

Explain how you classify trust stores. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 08

Explain how you inspect handshake parameters with OpenSSL. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 09

Explain how you evaluate cipher suites and forward secrecy. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 10

Explain how you validate server certificates and hostnames. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 11

Explain how you check key usage and extended key usage. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 12

Explain how you model ACME flows. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 13

Explain how you review web server TLS termination. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 14

Explain how you classify Kubernetes ingress TLS. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 15

Explain how you plan mTLS for service communication. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 16

Explain how you explain revocation through CRL or OCSP. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 17

Explain how you classify certificate transparency and monitoring. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 18

Explain how you evaluate HSTS and security headers. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 19

Explain how you disable legacy protocols. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 20

Explain how you monitor expiration dates. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 21

Explain how you handle key-compromise incidents. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 22

Explain how you troubleshoot TLS failures systematically. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 23

Explain how you distinguish TLS from SSL and plaintext protocols. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 24

Explain how you differentiate TLS 1.2 and TLS 1.3. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 25

Explain how you analyze X.509 certificates. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 26

Explain how you protect private keys. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 27

Explain how you create CSR and SAN correctly. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 28

Explain how you verify certificate chains. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 29

Explain how you classify trust stores. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 30

Explain how you inspect handshake parameters with OpenSSL. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 31

Explain how you evaluate cipher suites and forward secrecy. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 32

Explain how you validate server certificates and hostnames. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 33

Explain how you check key usage and extended key usage. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 34

Explain how you model ACME flows. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 35

Explain how you review web server TLS termination. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 36

Explain how you classify Kubernetes ingress TLS. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 37

Explain how you plan mTLS for service communication. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 38

Explain how you explain revocation through CRL or OCSP. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 39

Explain how you classify certificate transparency and monitoring. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 40

Explain how you evaluate HSTS and security headers. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 41

Explain how you disable legacy protocols. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 42

Explain how you monitor expiration dates. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 43

Explain how you handle key-compromise incidents. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 44

Explain how you troubleshoot TLS failures systematically. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 45

Explain how you distinguish TLS from SSL and plaintext protocols. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 46

Explain how you differentiate TLS 1.2 and TLS 1.3. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 47

Explain how you analyze X.509 certificates. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Question 48

Explain how you protect private keys. Name at least one command, one error case, one certificate or handshake evidence item and one security risk.

Practical Task

Create a local CA, a CSR with SAN, a server certificate and a chain. Check certificate, chain, validity, KU/EKU and document renewal and key-compromise recovery.

Review Checklist for Intermediate

• 01. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 02. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 03. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 04. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 05. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 06. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 07. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 08. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 09. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 10. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 11. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 12. write team rule: Record the affected service, certificate, key, chain and risk.
• 13. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 14. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 15. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 16. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 17. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 18. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 19. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 20. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 21. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 22. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 23. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 24. write team rule: Record the affected service, certificate, key, chain and risk.
• 25. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 26. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 27. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 28. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 29. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 30. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 31. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 32. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 33. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 34. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 35. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 36. write team rule: Record the affected service, certificate, key, chain and risk.
• 37. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 38. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 39. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 40. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 41. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 42. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 43. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 44. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 45. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.

Practice Appendix: Intermediate

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A051. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A052. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A053. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A054. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A055. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A056. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A057. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A058. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A059. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A060. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A061. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A062. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A063. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A064. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A065. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A066. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A067. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A068. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A069. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A070. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A071. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A072. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A073. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A074. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A075. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A076. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A077. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A078. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A079. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A080. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.