Format

• written questions
• practical OpenSSL task
• review of a risky TLS scenario
• short operations and security assessment

Expected Answer Profile

A good answer explains not only commands but supports certificate, chain, trust, protocol and recovery decisions with concrete evidence.

Questions

Solution 01

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for distinguish TLS from SSL and plaintext protocols.

Solution 02

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for differentiate TLS 1.2 and TLS 1.3.

Solution 03

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for analyze X.509 certificates.

Solution 04

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for protect private keys.

Solution 05

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for create CSR and SAN correctly.

Solution 06

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for verify certificate chains.

Solution 07

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for classify trust stores.

Solution 08

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for inspect handshake parameters with OpenSSL.

Solution 09

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for evaluate cipher suites and forward secrecy.

Solution 10

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for validate server certificates and hostnames.

Solution 11

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for check key usage and extended key usage.

Solution 12

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for model ACME flows.

Solution 13

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for review web server TLS termination.

Solution 14

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for classify Kubernetes ingress TLS.

Solution 15

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for plan mTLS for service communication.

Solution 16

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for explain revocation through CRL or OCSP.

Solution 17

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for classify certificate transparency and monitoring.

Solution 18

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for evaluate HSTS and security headers.

Solution 19

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for disable legacy protocols.

Solution 20

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for monitor expiration dates.

Solution 21

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for handle key-compromise incidents.

Solution 22

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for troubleshoot TLS failures systematically.

Solution 23

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for distinguish TLS from SSL and plaintext protocols.

Solution 24

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for differentiate TLS 1.2 and TLS 1.3.

Solution 25

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for analyze X.509 certificates.

Solution 26

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for protect private keys.

Solution 27

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for create CSR and SAN correctly.

Solution 28

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for verify certificate chains.

Solution 29

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for classify trust stores.

Solution 30

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for inspect handshake parameters with OpenSSL.

Solution 31

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for evaluate cipher suites and forward secrecy.

Solution 32

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for validate server certificates and hostnames.

Solution 33

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for check key usage and extended key usage.

Solution 34

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for model ACME flows.

Solution 35

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for review web server TLS termination.

Solution 36

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for classify Kubernetes ingress TLS.

Solution 37

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for plan mTLS for service communication.

Solution 38

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for explain revocation through CRL or OCSP.

Solution 39

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for classify certificate transparency and monitoring.

Solution 40

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for evaluate HSTS and security headers.

Solution 41

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for disable legacy protocols.

Solution 42

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for monitor expiration dates.

Solution 43

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for handle key-compromise incidents.

Solution 44

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for troubleshoot TLS failures systematically.

Solution 45

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for distinguish TLS from SSL and plaintext protocols.

Solution 46

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for differentiate TLS 1.2 and TLS 1.3.

Solution 47

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for analyze X.509 certificates.

Solution 48

Expected: name identity, check certificate and SAN, classify chain and trust store, explain protocol or cipher risk and provide concrete evidence for protect private keys.

Practical Task

Create a local CA, a CSR with SAN, a server certificate and a chain. Check certificate, chain, validity, KU/EKU and document renewal and key-compromise recovery.

Review Checklist for Advanced Security

• 01. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 02. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 03. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 04. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 05. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 06. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 07. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 08. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 09. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 10. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 11. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 12. write team rule: Record the affected service, certificate, key, chain and risk.
• 13. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 14. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 15. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 16. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 17. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 18. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 19. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 20. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 21. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 22. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 23. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 24. write team rule: Record the affected service, certificate, key, chain and risk.
• 25. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 26. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 27. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 28. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 29. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 30. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 31. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 32. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 33. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 34. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 35. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 36. write team rule: Record the affected service, certificate, key, chain and risk.
• 37. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 38. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 39. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 40. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 41. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 42. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 43. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 44. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 45. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.

Practice Appendix: Advanced Security

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A051. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A052. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A053. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A054. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A055. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A056. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A057. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A058. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A059. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A060. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A061. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A062. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A063. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A064. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A065. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A066. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A067. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A068. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A069. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A070. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A071. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A072. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A073. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A074. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A075. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A076. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A077. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A078. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A079. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A080. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.