Best Practices: TLS

This document belongs to the TLS workshop and describes best-practices as training material, reference documentation and review basis.

Target State

You should not treat TLS as a checkbox for HTTPS, but as an interaction of protocol version, cryptography, certificates, trust stores, validity, automation and incident response. The critical questions are: who is trusted, which key protects which identity, which protocol and cipher policy applies, how is renewal handled and what happens during compromise?

Focus

TLS 1.3
TLS 1.2 Hardening
Key Protection
Chain Delivery
Monitoring
Rotation

Core Terms

Term	Meaning
`TLS`	Transport Layer Security, a protocol protecting confidentiality, integrity and authenticity at the transport layer.
`SSL`	Historical predecessor family of TLS; SSLv2 and SSLv3 are obsolete and must not be treated as target state.
`TLS 1.3`	Current major TLS version from RFC 8446 with a reduced handshake, modern cryptography and removal of many older options.
`TLS 1.2`	Widely deployed older TLS version; per RFC 9325 only acceptable with modern cipher suites, extensions and careful configuration.
`X.509`	Certificate format for public keys, identities, validity, extensions and signatures in PKI systems.
`Certificate Authority`	Trust anchor or issuing authority that signs certificates and is controlled through policies, audits and processes.
`CSR`	Certificate Signing Request with public key and requested identity information.
`SAN`	Subject Alternative Name; relevant extension for DNS and IP names in server certificates.
`Key Usage`	X.509 extension limiting permitted key usages.
`Extended Key Usage`	X.509 extension for purposes such as Server Authentication or Client Authentication.
`Certificate Chain`	Chain of end-entity certificate, intermediate certificates and root trust anchor.
`Trust Store`	Set of trusted root certificates in operating system, browser, JVM, container or application.
`Handshake`	TLS negotiation of version, parameters, key material, certificates and security context.
`Cipher Suite`	Named selection of cryptographic algorithms; structured differently in TLS 1.3 than TLS 1.2.
`Forward Secrecy`	Property where later compromise of a long-term key does not decrypt past sessions.
`mTLS`	Mutual TLS where client and server authenticate each other with certificates.
`ACME`	Automation protocol from RFC 8555 for certificate request, validation, issuance and renewal.
`OCSP`	Online Certificate Status Protocol for certificate status checks; often deployed with stapling.
`CRL`	Certificate Revocation List for revoked certificates.
`HSTS`	HTTP Strict Transport Security, a browser mechanism enforcing HTTPS use for a domain.

Reference Commands

# Version und lokale Algorithmen prüfen
openssl version -a
openssl ciphers -v 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'

# Zertifikat und CSR prüfen
openssl x509 -in certs/server.crt -noout -text
openssl req -in csr/server.csr -noout -text
openssl verify -CAfile ca/root.crt -untrusted ca/intermediate.crt certs/server.crt

# Verbindung analysieren
openssl s_client -connect example.org:443 -servername example.org -showcerts -tls1_3
curl -Iv --tlsv1.2 https://example.org/

# Fingerprints und Ablaufdaten
openssl x509 -in certs/server.crt -noout -fingerprint -sha256
openssl x509 -in certs/server.crt -noout -dates

Working Model

Define service, hostname, identity, trust store and protection need.
Check certificate, SAN, key usage, extended key usage, validity and chain.
Check protocol versions, cipher suites, forward secrecy and legacy removal.
Support changes with OpenSSL output, chain verification, configuration diffs and monitoring evidence.
Review private-key protection, renewal, revocation, CT, HSTS and mTLS identities.
Document recovery: reissue, key rotation, revocation, trust-store repair, rollback and postmortem.

Typical Decisions

Decision	Good Review Question	Risk if Wrong
TLS version	Does legacy client compatibility require TLS 1.2 or is TLS 1.3 possible?	unnecessary attack surface or connection failures
Certificate source	public CA, internal CA, ACME or manual PKI?	wrong trust model or uncontrolled issuance
SAN and identity	Which DNS and IP names must really be authenticated?	hostname mismatch or overly broad certificates
Key protection	Where is the private key and who can read it?	key leakage, unauthorized identity use
Revocation	Is rotation enough or does the case need CRL/OCSP/compensating controls?	compromised certificates remain usable
HSTS	Is IncludeSubDomains or preload operationally safe?	persistent outage due to incomplete HTTPS coverage

Diagrams and Models

The diagrams are text-based on purpose so they remain reviewable without extra tooling.

ClientHello -> ServerHello -> EncryptedExtensions -> Certificate -> Finished
     |              |                 |                 |
 version/SNI    key share        parameters       identity/trust

Root CA -> Intermediate CA -> Server Certificate
   |             |                    |
trust store   chain file          SAN, EKU, key usage, validity

ACME
  account -> order -> challenge -> validation -> issuance -> renewal -> monitoring

Incident
  detect -> freeze -> rotate key -> reissue cert -> revoke old cert -> deploy -> verify -> postmortem

Operations Notes

RFC 9325 replaces RFC 7525 as Best Current Practice guidance and emphasizes TLS 1.3 and hardened TLS 1.2.
NIST SP 800-52 Rev. 2 was published in 2019 and is under NIST review since 2026; requirements must be checked against current context.
Publicly trusted TLS server certificates are subject to CA/Browser Forum Baseline Requirements; internal PKI has its own policies.
OpenSSL commands inspect artifacts but do not replace full browser, client or production-path testing.
Private keys, ACME account keys, mTLS client keys and trust-store changes are security-relevant.

Sources and References

Practice Appendix: Best Practices

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. TLS 1.3

Task: check certificate and SAN and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. TLS 1.2 Hardening

Task: review private-key protection and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. Key Protection

Task: validate complete chain and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. Chain Delivery

Task: review TLS version and cipher policy and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. Monitoring

Task: document trust-store assumption and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. Rotation

Task: check expiration date and renewal path and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. TLS 1.3

Task: explain revocation model and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. TLS 1.2 Hardening

Task: evaluate mTLS identity and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. Key Protection

Task: mark HSTS or header risk and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. Chain Delivery

Task: name monitoring or alert rule and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. Rotation

Task: write team rule and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. TLS 1.3

Task: check certificate and SAN and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. TLS 1.2 Hardening

Task: review private-key protection and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. Key Protection

Task: validate complete chain and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. Chain Delivery

Task: review TLS version and cipher policy and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. Monitoring

Task: document trust-store assumption and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. Rotation

Task: check expiration date and renewal path and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. TLS 1.3

Task: explain revocation model and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. TLS 1.2 Hardening

Task: evaluate mTLS identity and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. Key Protection

Task: mark HSTS or header risk and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. Chain Delivery

Task: name monitoring or alert rule and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. Rotation

Task: write team rule and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. TLS 1.3

Task: check certificate and SAN and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. TLS 1.2 Hardening

Task: review private-key protection and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. Key Protection

Task: validate complete chain and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. Chain Delivery

Task: review TLS version and cipher policy and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. Monitoring

Task: document trust-store assumption and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. Rotation

Task: check expiration date and renewal path and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. TLS 1.3

Task: explain revocation model and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. TLS 1.2 Hardening

Task: evaluate mTLS identity and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. Key Protection

Task: mark HSTS or header risk and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. Chain Delivery

Task: name monitoring or alert rule and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. Rotation

Task: write team rule and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. TLS 1.3

Task: check certificate and SAN and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. TLS 1.2 Hardening

Task: review private-key protection and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. Key Protection

Task: validate complete chain and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. Chain Delivery

Task: review TLS version and cipher policy and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. Monitoring

Task: document trust-store assumption and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. Rotation

Task: check expiration date and renewal path and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. TLS 1.3

Task: explain revocation model and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. TLS 1.2 Hardening

Task: evaluate mTLS identity and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. Key Protection

Task: mark HSTS or header risk and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. Chain Delivery

Task: name monitoring or alert rule and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. Rotation

Task: write team rule and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. TLS 1.3

Task: check certificate and SAN and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. TLS 1.2 Hardening

Task: review private-key protection and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A051. Key Protection

Task: validate complete chain and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A052. Chain Delivery

Task: review TLS version and cipher policy and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A053. Monitoring

Task: document trust-store assumption and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A054. Rotation

Task: check expiration date and renewal path and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A055. TLS 1.3

Task: explain revocation model and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A056. TLS 1.2 Hardening

Task: evaluate mTLS identity and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A057. Key Protection

Task: mark HSTS or header risk and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A058. Chain Delivery

Task: name monitoring or alert rule and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A059. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A060. Rotation

Task: write team rule and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A061. TLS 1.3

Task: check certificate and SAN and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A062. TLS 1.2 Hardening

Task: review private-key protection and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A063. Key Protection

Task: validate complete chain and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A064. Chain Delivery

Task: review TLS version and cipher policy and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A065. Monitoring

Task: document trust-store assumption and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A066. Rotation

Task: check expiration date and renewal path and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A067. TLS 1.3

Task: explain revocation model and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A068. TLS 1.2 Hardening

Task: evaluate mTLS identity and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A069. Key Protection

Task: mark HSTS or header risk and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A070. Chain Delivery

Task: name monitoring or alert rule and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A071. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A072. Rotation

Task: write team rule and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A073. TLS 1.3

Task: check certificate and SAN and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A074. TLS 1.2 Hardening

Task: review private-key protection and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A075. Key Protection

Task: validate complete chain and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A076. Chain Delivery

Task: review TLS version and cipher policy and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A077. Monitoring

Task: document trust-store assumption and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A078. Rotation

Task: check expiration date and renewal path and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A079. TLS 1.3

Task: explain revocation model and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A080. TLS 1.2 Hardening

Task: evaluate mTLS identity and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A081. Key Protection

Task: mark HSTS or header risk and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A082. Chain Delivery

Task: name monitoring or alert rule and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A083. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A084. Rotation

Task: write team rule and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A085. TLS 1.3

Task: check certificate and SAN and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A086. TLS 1.2 Hardening

Task: review private-key protection and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A087. Key Protection

Task: validate complete chain and connect the observation explicitly to Key Protection.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A088. Chain Delivery

Task: review TLS version and cipher policy and connect the observation explicitly to Chain Delivery.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A089. Monitoring

Task: document trust-store assumption and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A090. Rotation

Task: check expiration date and renewal path and connect the observation explicitly to Rotation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A091. TLS 1.3

Task: explain revocation model and connect the observation explicitly to TLS 1.3.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A092. TLS 1.2 Hardening

Task: evaluate mTLS identity and connect the observation explicitly to TLS 1.2 Hardening.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.