X509 Certificate Anatomy (EN)

Focus: Subject, Issuer, SAN, Key Usage und Laufzeit.

Purpose

This example is a controlled TLS lab. It creates a local test CA, a CSR, a server certificate, OpenSSL evidence and a policy review below work/.

Local Check

./run.sh

Learning Goals

trace certificate content
check SAN, KU/EKU and validity
run chain verification
check TLS policy against review rules
derive recovery and monitoring questions

Files

Practice Appendix: X509 Certificate Anatomy

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: check certificate and SAN and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. TLS

Task: review private-key protection and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. X.509

Task: validate complete chain and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: document trust-store assumption and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. TLS

Task: check expiration date and renewal path and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. X.509

Task: explain revocation model and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. Security

Task: evaluate mTLS identity and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: mark HSTS or header risk and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. TLS

Task: name monitoring or alert rule and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. X.509

Task: record incident recovery path and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: check certificate and SAN and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. TLS

Task: review private-key protection and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. X.509

Task: validate complete chain and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: document trust-store assumption and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. TLS

Task: check expiration date and renewal path and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. X.509

Task: explain revocation model and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. Security

Task: evaluate mTLS identity and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: mark HSTS or header risk and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. TLS

Task: name monitoring or alert rule and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. X.509

Task: record incident recovery path and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: check certificate and SAN and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. TLS

Task: review private-key protection and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. X.509

Task: validate complete chain and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: document trust-store assumption and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. TLS

Task: check expiration date and renewal path and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. X.509

Task: explain revocation model and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. Security

Task: evaluate mTLS identity and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: mark HSTS or header risk and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. TLS

Task: name monitoring or alert rule and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. X.509

Task: record incident recovery path and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: check certificate and SAN and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. TLS

Task: review private-key protection and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. X.509

Task: validate complete chain and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: document trust-store assumption and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. TLS

Task: check expiration date and renewal path and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. X.509

Task: explain revocation model and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. Security

Task: evaluate mTLS identity and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: mark HSTS or header risk and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. TLS

Task: name monitoring or alert rule and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. X.509

Task: record incident recovery path and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. Security

Task: write team rule and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: check certificate and SAN and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. TLS

Task: review private-key protection and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A051. X.509

Task: validate complete chain and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A052. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A053. Subject, Issuer, SAN, Key Usage und Laufzeit

Task: document trust-store assumption and connect the observation explicitly to Subject, Issuer, SAN, Key Usage und Laufzeit.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A054. TLS

Task: check expiration date and renewal path and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A055. X.509

Task: explain revocation model and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.