Security: TLS

This document belongs to the TLS workshop and describes security as training material, reference documentation and review basis.

Target State

You should not treat TLS as a checkbox for HTTPS, but as an interaction of protocol version, cryptography, certificates, trust stores, validity, automation and incident response. The critical questions are: who is trusted, which key protects which identity, which protocol and cipher policy applies, how is renewal handled and what happens during compromise?

Focus

Private Keys
Legacy Protocols
Cipher Policy
Revocation
CT
mTLS
IR

Core Terms

Term	Meaning
`TLS`	Transport Layer Security, a protocol protecting confidentiality, integrity and authenticity at the transport layer.
`SSL`	Historical predecessor family of TLS; SSLv2 and SSLv3 are obsolete and must not be treated as target state.
`TLS 1.3`	Current major TLS version from RFC 8446 with a reduced handshake, modern cryptography and removal of many older options.
`TLS 1.2`	Widely deployed older TLS version; per RFC 9325 only acceptable with modern cipher suites, extensions and careful configuration.
`X.509`	Certificate format for public keys, identities, validity, extensions and signatures in PKI systems.
`Certificate Authority`	Trust anchor or issuing authority that signs certificates and is controlled through policies, audits and processes.
`CSR`	Certificate Signing Request with public key and requested identity information.
`SAN`	Subject Alternative Name; relevant extension for DNS and IP names in server certificates.
`Key Usage`	X.509 extension limiting permitted key usages.
`Extended Key Usage`	X.509 extension for purposes such as Server Authentication or Client Authentication.
`Certificate Chain`	Chain of end-entity certificate, intermediate certificates and root trust anchor.
`Trust Store`	Set of trusted root certificates in operating system, browser, JVM, container or application.
`Handshake`	TLS negotiation of version, parameters, key material, certificates and security context.
`Cipher Suite`	Named selection of cryptographic algorithms; structured differently in TLS 1.3 than TLS 1.2.
`Forward Secrecy`	Property where later compromise of a long-term key does not decrypt past sessions.
`mTLS`	Mutual TLS where client and server authenticate each other with certificates.
`ACME`	Automation protocol from RFC 8555 for certificate request, validation, issuance and renewal.
`OCSP`	Online Certificate Status Protocol for certificate status checks; often deployed with stapling.
`CRL`	Certificate Revocation List for revoked certificates.
`HSTS`	HTTP Strict Transport Security, a browser mechanism enforcing HTTPS use for a domain.

Reference Commands

# Version und lokale Algorithmen prüfen
openssl version -a
openssl ciphers -v 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'

# Zertifikat und CSR prüfen
openssl x509 -in certs/server.crt -noout -text
openssl req -in csr/server.csr -noout -text
openssl verify -CAfile ca/root.crt -untrusted ca/intermediate.crt certs/server.crt

# Verbindung analysieren
openssl s_client -connect example.org:443 -servername example.org -showcerts -tls1_3
curl -Iv --tlsv1.2 https://example.org/

# Fingerprints und Ablaufdaten
openssl x509 -in certs/server.crt -noout -fingerprint -sha256
openssl x509 -in certs/server.crt -noout -dates

Working Model

Define service, hostname, identity, trust store and protection need.
Check certificate, SAN, key usage, extended key usage, validity and chain.
Check protocol versions, cipher suites, forward secrecy and legacy removal.
Support changes with OpenSSL output, chain verification, configuration diffs and monitoring evidence.
Review private-key protection, renewal, revocation, CT, HSTS and mTLS identities.
Document recovery: reissue, key rotation, revocation, trust-store repair, rollback and postmortem.

Typical Decisions

Decision	Good Review Question	Risk if Wrong
TLS version	Does legacy client compatibility require TLS 1.2 or is TLS 1.3 possible?	unnecessary attack surface or connection failures
Certificate source	public CA, internal CA, ACME or manual PKI?	wrong trust model or uncontrolled issuance
SAN and identity	Which DNS and IP names must really be authenticated?	hostname mismatch or overly broad certificates
Key protection	Where is the private key and who can read it?	key leakage, unauthorized identity use
Revocation	Is rotation enough or does the case need CRL/OCSP/compensating controls?	compromised certificates remain usable
HSTS	Is IncludeSubDomains or preload operationally safe?	persistent outage due to incomplete HTTPS coverage

Diagrams and Models

The diagrams are text-based on purpose so they remain reviewable without extra tooling.

ClientHello -> ServerHello -> EncryptedExtensions -> Certificate -> Finished
     |              |                 |                 |
 version/SNI    key share        parameters       identity/trust

Root CA -> Intermediate CA -> Server Certificate
   |             |                    |
trust store   chain file          SAN, EKU, key usage, validity

ACME
  account -> order -> challenge -> validation -> issuance -> renewal -> monitoring

Incident
  detect -> freeze -> rotate key -> reissue cert -> revoke old cert -> deploy -> verify -> postmortem

Operations Notes

RFC 9325 replaces RFC 7525 as Best Current Practice guidance and emphasizes TLS 1.3 and hardened TLS 1.2.
NIST SP 800-52 Rev. 2 was published in 2019 and is under NIST review since 2026; requirements must be checked against current context.
Publicly trusted TLS server certificates are subject to CA/Browser Forum Baseline Requirements; internal PKI has its own policies.
OpenSSL commands inspect artifacts but do not replace full browser, client or production-path testing.
Private keys, ACME account keys, mTLS client keys and trust-store changes are security-relevant.

Sources and References

Practice Appendix: Security

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. Private Keys

Task: check certificate and SAN and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. Legacy Protocols

Task: review private-key protection and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. Cipher Policy

Task: validate complete chain and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. Revocation

Task: review TLS version and cipher policy and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. CT

Task: document trust-store assumption and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. mTLS

Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. IR

Task: explain revocation model and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. Private Keys

Task: evaluate mTLS identity and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. Legacy Protocols

Task: mark HSTS or header risk and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. Cipher Policy

Task: name monitoring or alert rule and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. Revocation

Task: record incident recovery path and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. CT

Task: write team rule and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. mTLS

Task: check certificate and SAN and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. IR

Task: review private-key protection and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. Private Keys

Task: validate complete chain and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. Legacy Protocols

Task: review TLS version and cipher policy and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. Cipher Policy

Task: document trust-store assumption and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. Revocation

Task: check expiration date and renewal path and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. CT

Task: explain revocation model and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. mTLS

Task: evaluate mTLS identity and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. IR

Task: mark HSTS or header risk and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. Private Keys

Task: name monitoring or alert rule and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. Legacy Protocols

Task: record incident recovery path and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. Cipher Policy

Task: write team rule and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. Revocation

Task: check certificate and SAN and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. CT

Task: review private-key protection and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. mTLS

Task: validate complete chain and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. IR

Task: review TLS version and cipher policy and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. Private Keys

Task: document trust-store assumption and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. Legacy Protocols

Task: check expiration date and renewal path and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. Cipher Policy

Task: explain revocation model and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. Revocation

Task: evaluate mTLS identity and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. CT

Task: mark HSTS or header risk and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. mTLS

Task: name monitoring or alert rule and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. IR

Task: record incident recovery path and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. Private Keys

Task: write team rule and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. Legacy Protocols

Task: check certificate and SAN and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. Cipher Policy

Task: review private-key protection and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. Revocation

Task: validate complete chain and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. CT

Task: review TLS version and cipher policy and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. mTLS

Task: document trust-store assumption and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. IR

Task: check expiration date and renewal path and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. Private Keys

Task: explain revocation model and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. Legacy Protocols

Task: evaluate mTLS identity and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. Cipher Policy

Task: mark HSTS or header risk and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. Revocation

Task: name monitoring or alert rule and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. CT

Task: record incident recovery path and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. mTLS

Task: write team rule and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. IR

Task: check certificate and SAN and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. Private Keys

Task: review private-key protection and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A051. Legacy Protocols

Task: validate complete chain and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A052. Cipher Policy

Task: review TLS version and cipher policy and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A053. Revocation

Task: document trust-store assumption and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A054. CT

Task: check expiration date and renewal path and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A055. mTLS

Task: explain revocation model and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A056. IR

Task: evaluate mTLS identity and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A057. Private Keys

Task: mark HSTS or header risk and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A058. Legacy Protocols

Task: name monitoring or alert rule and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A059. Cipher Policy

Task: record incident recovery path and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A060. Revocation

Task: write team rule and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A061. CT

Task: check certificate and SAN and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A062. mTLS

Task: review private-key protection and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A063. IR

Task: validate complete chain and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A064. Private Keys

Task: review TLS version and cipher policy and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A065. Legacy Protocols

Task: document trust-store assumption and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A066. Cipher Policy

Task: check expiration date and renewal path and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A067. Revocation

Task: explain revocation model and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A068. CT

Task: evaluate mTLS identity and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A069. mTLS

Task: mark HSTS or header risk and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A070. IR

Task: name monitoring or alert rule and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A071. Private Keys

Task: record incident recovery path and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A072. Legacy Protocols

Task: write team rule and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A073. Cipher Policy

Task: check certificate and SAN and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A074. Revocation

Task: review private-key protection and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A075. CT

Task: validate complete chain and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A076. mTLS

Task: review TLS version and cipher policy and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A077. IR

Task: document trust-store assumption and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A078. Private Keys

Task: check expiration date and renewal path and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A079. Legacy Protocols

Task: explain revocation model and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A080. Cipher Policy

Task: evaluate mTLS identity and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A081. Revocation

Task: mark HSTS or header risk and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A082. CT

Task: name monitoring or alert rule and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A083. mTLS

Task: record incident recovery path and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A084. IR

Task: write team rule and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A085. Private Keys

Task: check certificate and SAN and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A086. Legacy Protocols

Task: review private-key protection and connect the observation explicitly to Legacy Protocols.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A087. Cipher Policy

Task: validate complete chain and connect the observation explicitly to Cipher Policy.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A088. Revocation

Task: review TLS version and cipher policy and connect the observation explicitly to Revocation.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A089. CT

Task: document trust-store assumption and connect the observation explicitly to CT.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A090. mTLS

Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A091. IR

Task: explain revocation model and connect the observation explicitly to IR.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A092. Private Keys

Task: evaluate mTLS identity and connect the observation explicitly to Private Keys.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.