Purpose

This example is a controlled TLS lab. It creates a local test CA, a CSR, a server certificate, OpenSSL evidence and a policy review below work/.

Local Check

./run.sh

Learning Goals

• trace certificate content
• check SAN, KU/EKU and validity
• run chain verification
• check TLS policy against review rules
• derive recovery and monitoring questions

Files

• openssl-server.cnf
• tls-policy.json
• runbook.txt
• run.sh

Review Checklist for Private Key Protection

• 01. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 02. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 03. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 04. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 05. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 06. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 07. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 08. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 09. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 10. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 11. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 12. write team rule: Record the affected service, certificate, key, chain and risk.
• 13. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 14. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 15. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 16. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 17. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 18. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 19. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 20. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 21. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 22. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 23. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 24. write team rule: Record the affected service, certificate, key, chain and risk.
• 25. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 26. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 27. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 28. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 29. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 30. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 31. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 32. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 33. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 34. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 35. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 36. write team rule: Record the affected service, certificate, key, chain and risk.
• 37. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 38. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 39. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 40. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 41. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 42. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 43. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 44. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.

Practice Appendix: Private Key Protection

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: check certificate and SAN and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. TLS

• Task: review private-key protection and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. X.509

• Task: validate complete chain and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: document trust-store assumption and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. TLS

• Task: check expiration date and renewal path and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. X.509

• Task: explain revocation model and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: mark HSTS or header risk and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. TLS

• Task: name monitoring or alert rule and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. X.509

• Task: record incident recovery path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: check certificate and SAN and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. TLS

• Task: review private-key protection and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. X.509

• Task: validate complete chain and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: document trust-store assumption and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. TLS

• Task: check expiration date and renewal path and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. X.509

• Task: explain revocation model and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: mark HSTS or header risk and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. TLS

• Task: name monitoring or alert rule and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. X.509

• Task: record incident recovery path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: check certificate and SAN and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. TLS

• Task: review private-key protection and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. X.509

• Task: validate complete chain and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: document trust-store assumption and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. TLS

• Task: check expiration date and renewal path and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. X.509

• Task: explain revocation model and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: mark HSTS or header risk and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. TLS

• Task: name monitoring or alert rule and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. X.509

• Task: record incident recovery path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: check certificate and SAN and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. TLS

• Task: review private-key protection and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. X.509

• Task: validate complete chain and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: document trust-store assumption and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. TLS

• Task: check expiration date and renewal path and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. X.509

• Task: explain revocation model and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. Security

• Task: evaluate mTLS identity and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: mark HSTS or header risk and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. TLS

• Task: name monitoring or alert rule and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. X.509

• Task: record incident recovery path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. Security

• Task: write team rule and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: check certificate and SAN and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. TLS

• Task: review private-key protection and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A051. X.509

• Task: validate complete chain and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A052. Security

• Task: review TLS version and cipher policy and connect the observation explicitly to Security.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A053. Private-Key-Dateirechte und Passphrase-Entscheidungen

• Task: document trust-store assumption and connect the observation explicitly to Private-Key-Dateirechte und Passphrase-Entscheidungen.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A054. TLS

• Task: check expiration date and renewal path and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A055. X.509

• Task: explain revocation model and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.