cert-manager Issuer Model
Focus: Issuer, Certificate und Renewal in Kubernetes.
Purpose
This example is a controlled TLS workshop lab. It creates local test keys and certificates only and does not contact production services.
Documentation
Files
Run
./run.sh
The script writes private test keys and evidence below work/. That directory is ignored by Git.
Review Questions
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
- How does this example demonstrate
Issuer, Certificate und Renewal in Kuberneteswith safe TLS behavior?
- How does this example demonstrate
Practice Appendix: Example cert-manager Issuer Model
This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.
A001. Issuer, Certificate und Renewal in Kubernetes
- Task: check certificate and SAN and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A002. TLS
- Task: review private-key protection and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A003. X.509
- Task: validate complete chain and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A004. Security
- Task: review TLS version and cipher policy and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A005. Issuer, Certificate und Renewal in Kubernetes
- Task: document trust-store assumption and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A006. TLS
- Task: check expiration date and renewal path and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A007. X.509
- Task: explain revocation model and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A008. Security
- Task: evaluate mTLS identity and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A009. Issuer, Certificate und Renewal in Kubernetes
- Task: mark HSTS or header risk and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A010. TLS
- Task: name monitoring or alert rule and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A011. X.509
- Task: record incident recovery path and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A012. Security
- Task: write team rule and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A013. Issuer, Certificate und Renewal in Kubernetes
- Task: check certificate and SAN and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A014. TLS
- Task: review private-key protection and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A015. X.509
- Task: validate complete chain and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A016. Security
- Task: review TLS version and cipher policy and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A017. Issuer, Certificate und Renewal in Kubernetes
- Task: document trust-store assumption and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A018. TLS
- Task: check expiration date and renewal path and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A019. X.509
- Task: explain revocation model and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A020. Security
- Task: evaluate mTLS identity and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A021. Issuer, Certificate und Renewal in Kubernetes
- Task: mark HSTS or header risk and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A022. TLS
- Task: name monitoring or alert rule and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A023. X.509
- Task: record incident recovery path and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A024. Security
- Task: write team rule and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A025. Issuer, Certificate und Renewal in Kubernetes
- Task: check certificate and SAN and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A026. TLS
- Task: review private-key protection and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A027. X.509
- Task: validate complete chain and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A028. Security
- Task: review TLS version and cipher policy and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A029. Issuer, Certificate und Renewal in Kubernetes
- Task: document trust-store assumption and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A030. TLS
- Task: check expiration date and renewal path and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A031. X.509
- Task: explain revocation model and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A032. Security
- Task: evaluate mTLS identity and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A033. Issuer, Certificate und Renewal in Kubernetes
- Task: mark HSTS or header risk and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A034. TLS
- Task: name monitoring or alert rule and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A035. X.509
- Task: record incident recovery path and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A036. Security
- Task: write team rule and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A037. Issuer, Certificate und Renewal in Kubernetes
- Task: check certificate and SAN and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A038. TLS
- Task: review private-key protection and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A039. X.509
- Task: validate complete chain and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A040. Security
- Task: review TLS version and cipher policy and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A041. Issuer, Certificate und Renewal in Kubernetes
- Task: document trust-store assumption and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A042. TLS
- Task: check expiration date and renewal path and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A043. X.509
- Task: explain revocation model and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A044. Security
- Task: evaluate mTLS identity and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A045. Issuer, Certificate und Renewal in Kubernetes
- Task: mark HSTS or header risk and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A046. TLS
- Task: name monitoring or alert rule and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A047. X.509
- Task: record incident recovery path and connect the observation explicitly to
X.509. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A048. Security
- Task: write team rule and connect the observation explicitly to
Security. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A049. Issuer, Certificate und Renewal in Kubernetes
- Task: check certificate and SAN and connect the observation explicitly to
Issuer, Certificate und Renewal in Kubernetes. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
A050. TLS
- Task: review private-key protection and connect the observation explicitly to
TLS. - Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which keys, certificates, chains, trust stores or headers would be critical?
- Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.