Curriculum: TLS

This curriculum structures a TLS workshop from fundamentals to advanced operations and security response. It combines protocol understanding, certificate analysis, PKI, automation, web server and platform operations and incident response.

Curriculum Goal

After the full series you can analyze TLS connections, review certificates and chains, define secure policies, operate renewal and monitoring and handle key or certificate incidents.

Teaching Model

The workshop follows a repeating cycle:

Understand -> Create -> Verify -> Harden -> Automate -> Monitor -> Respond

Step	Goal	Typical Activity
Concept	understand protocol, PKI and trust	TLS 1.3, X.509, chain, trust store
Artifact	create key, CSR and certificate	OpenSSL config, SAN, KU/EKU
Verification	check chain and hostname	`openssl verify`, `openssl x509`, `s_client`
Hardening	evaluate versions and cipher policy	RFC 9325, NIST, server profiles
Automation	model renewal and deployment	ACME, cert-manager, secret rotation
Operations	prepare monitoring and incident response	expiration, CT, revocation, runbooks

Level Structure

Level	Focus	Outcome
Fundamentals	TLS-Grundlagen, SSL-Abgrenzung, Zertifikate, Keys, CAs, SANs, Trust und erste OpenSSL-Analyse	You can explain, locally check and operationally review the included TLS patterns.
Intermediate	Handshake, TLS 1.2/1.3, Cipher Suites, Chain-Building, CSR, Webserver und Debugging	You can explain, locally check and operationally review the included TLS patterns.
Professional	ACME, Automatisierung, Kubernetes Ingress, cert-manager, mTLS, Monitoring und Enterprise PKI	You can explain, locally check and operationally review the included TLS patterns.
Advanced Security	Hardening, Revocation, CT, HSTS, Legacy-Abbau, TLS Inspection, Key Compromise und Incident Response	You can explain, locally check and operationally review the included TLS patterns.

Roles and Learning Paths

Developers focus on HTTPS clients, hostname validation, mTLS clients and debugging.
Administrators focus on web servers, trust stores, certificate chains and renewal.
Platform engineers focus on ingress, cert-manager, ACME, service mesh and secret distribution.
Security engineers focus on cipher policy, revocation, CT, HSTS, key protection and incident response.

Lab Strategy

All labs run locally without production keys. Each example creates its own local CA, test certificates and evidence files below work/.

Assessment Rubric

Criterion	Basic	Good	Excellent
Correctness	certificate can be read	chain and SAN are checked	protocol, cipher and trust impact is explained
Security	no real keys in repo	key protection and validity are reviewed	revocation, rotation and IR are described
Operations	manual check possible	renewal and monitoring exist	automated runbook with escalation exists
Architecture	single service understood	platform and mTLS boundaries clear	PKI and trust model is reviewable

Sources and References

Practice Appendix: Curriculum

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. TLS

Task: check certificate and SAN and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. X.509

Task: review private-key protection and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. PKI

Task: validate complete chain and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. OpenSSL

Task: review TLS version and cipher policy and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. ACME

Task: document trust-store assumption and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. mTLS

Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. Monitoring

Task: explain revocation model and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. Security

Task: evaluate mTLS identity and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. TLS

Task: mark HSTS or header risk and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. X.509

Task: name monitoring or alert rule and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. PKI

Task: record incident recovery path and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. OpenSSL

Task: write team rule and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. ACME

Task: check certificate and SAN and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. mTLS

Task: review private-key protection and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. Monitoring

Task: validate complete chain and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. TLS

Task: document trust-store assumption and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. X.509

Task: check expiration date and renewal path and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. PKI

Task: explain revocation model and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. OpenSSL

Task: evaluate mTLS identity and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. ACME

Task: mark HSTS or header risk and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. mTLS

Task: name monitoring or alert rule and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. TLS

Task: check certificate and SAN and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. X.509

Task: review private-key protection and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. PKI

Task: validate complete chain and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. OpenSSL

Task: review TLS version and cipher policy and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. ACME

Task: document trust-store assumption and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. mTLS

Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. Monitoring

Task: explain revocation model and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. Security

Task: evaluate mTLS identity and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. TLS

Task: mark HSTS or header risk and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. X.509

Task: name monitoring or alert rule and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. PKI

Task: record incident recovery path and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. OpenSSL

Task: write team rule and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. ACME

Task: check certificate and SAN and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. mTLS

Task: review private-key protection and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. Monitoring

Task: validate complete chain and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. TLS

Task: document trust-store assumption and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. X.509

Task: check expiration date and renewal path and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. PKI

Task: explain revocation model and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. OpenSSL

Task: evaluate mTLS identity and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. ACME

Task: mark HSTS or header risk and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. mTLS

Task: name monitoring or alert rule and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. TLS

Task: check certificate and SAN and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. X.509

Task: review private-key protection and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A051. PKI

Task: validate complete chain and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A052. OpenSSL

Task: review TLS version and cipher policy and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A053. ACME

Task: document trust-store assumption and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A054. mTLS

Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A055. Monitoring

Task: explain revocation model and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A056. Security

Task: evaluate mTLS identity and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A057. TLS

Task: mark HSTS or header risk and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A058. X.509

Task: name monitoring or alert rule and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A059. PKI

Task: record incident recovery path and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A060. OpenSSL

Task: write team rule and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A061. ACME

Task: check certificate and SAN and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A062. mTLS

Task: review private-key protection and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A063. Monitoring

Task: validate complete chain and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A064. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A065. TLS

Task: document trust-store assumption and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A066. X.509

Task: check expiration date and renewal path and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A067. PKI

Task: explain revocation model and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A068. OpenSSL

Task: evaluate mTLS identity and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A069. ACME

Task: mark HSTS or header risk and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A070. mTLS

Task: name monitoring or alert rule and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A071. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A072. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A073. TLS

Task: check certificate and SAN and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A074. X.509

Task: review private-key protection and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A075. PKI

Task: validate complete chain and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A076. OpenSSL

Task: review TLS version and cipher policy and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A077. ACME

Task: document trust-store assumption and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A078. mTLS

Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A079. Monitoring

Task: explain revocation model and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A080. Security

Task: evaluate mTLS identity and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A081. TLS

Task: mark HSTS or header risk and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A082. X.509

Task: name monitoring or alert rule and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A083. PKI

Task: record incident recovery path and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A084. OpenSSL

Task: write team rule and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A085. ACME

Task: check certificate and SAN and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A086. mTLS

Task: review private-key protection and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A087. Monitoring

Task: validate complete chain and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A088. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A089. TLS

Task: document trust-store assumption and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A090. X.509

Task: check expiration date and renewal path and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A091. PKI

Task: explain revocation model and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A092. OpenSSL

Task: evaluate mTLS identity and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A093. ACME

Task: mark HSTS or header risk and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A094. mTLS

Task: name monitoring or alert rule and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A095. Monitoring

Task: record incident recovery path and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A096. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A097. TLS

Task: check certificate and SAN and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A098. X.509

Task: review private-key protection and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A099. PKI

Task: validate complete chain and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A100. OpenSSL

Task: review TLS version and cipher policy and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A101. ACME

Task: document trust-store assumption and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A102. mTLS

Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A103. Monitoring

Task: explain revocation model and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A104. Security

Task: evaluate mTLS identity and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A105. TLS

Task: mark HSTS or header risk and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A106. X.509

Task: name monitoring or alert rule and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A107. PKI

Task: record incident recovery path and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A108. OpenSSL

Task: write team rule and connect the observation explicitly to OpenSSL.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A109. ACME

Task: check certificate and SAN and connect the observation explicitly to ACME.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A110. mTLS

Task: review private-key protection and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A111. Monitoring

Task: validate complete chain and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A112. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.