Orthevs Orthevs Fathom new horizons
Menu

Workshop wiki · English

PFS and Key Exchange Review (EN)

This example is a controlled TLS lab. It creates a local test CA, a CSR, a server certificate, OpenSSL evidence and a policy review below work/.

Content language · EnglishSize · 35.5 KBexamples/26-pfs-and-key-exchange-review/docs/en/README.md
Workshop examples as ZIP files
Learning progress in the web app

Mark chapters as read, view reading progress and check off practice modules after enabling the optional web app. Workshop progress is calculated from chapters across all document pages. Your choices stay on this device; there is no account or server sync. Installation is not required. Withdrawing your choice in Privacy settings deletes the progress.

Reading progress0%
0%
0 / 6 chapters read
Other language versionGerman ↗Greek ↗

PFS and Key Exchange Review (EN)

Focus: Forward Secrecy und Key Exchange.

Purpose

This example is a controlled TLS lab. It creates a local test CA, a CSR, a server certificate, OpenSSL evidence and a policy review below work/.

01 / 06

Local Check

bash
./run.sh
02 / 06

Learning Goals

  • trace certificate content
  • check SAN, KU/EKU and validity
  • run chain verification
  • check TLS policy against review rules
  • derive recovery and monitoring questions
03 / 06

Files

04 / 06

Review Checklist for PFS and Key Exchange Review

  • 01. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
  • 02. review private-key protection: Record the affected service, certificate, key, chain and risk.
  • 03. validate complete chain: Record the affected service, certificate, key, chain and risk.
  • 04. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
  • 05. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
  • 06. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
  • 07. explain revocation model: Record the affected service, certificate, key, chain and risk.
  • 08. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
  • 09. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
  • 10. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
  • 11. record incident recovery path: Record the affected service, certificate, key, chain and risk.
  • 12. write team rule: Record the affected service, certificate, key, chain and risk.
  • 13. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
  • 14. review private-key protection: Record the affected service, certificate, key, chain and risk.
  • 15. validate complete chain: Record the affected service, certificate, key, chain and risk.
  • 16. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
  • 17. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
  • 18. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
  • 19. explain revocation model: Record the affected service, certificate, key, chain and risk.
  • 20. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
  • 21. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
  • 22. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
  • 23. record incident recovery path: Record the affected service, certificate, key, chain and risk.
  • 24. write team rule: Record the affected service, certificate, key, chain and risk.
  • 25. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
  • 26. review private-key protection: Record the affected service, certificate, key, chain and risk.
  • 27. validate complete chain: Record the affected service, certificate, key, chain and risk.
  • 28. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
  • 29. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
  • 30. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
  • 31. explain revocation model: Record the affected service, certificate, key, chain and risk.
  • 32. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
  • 33. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
  • 34. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
  • 35. record incident recovery path: Record the affected service, certificate, key, chain and risk.
  • 36. write team rule: Record the affected service, certificate, key, chain and risk.
  • 37. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
  • 38. review private-key protection: Record the affected service, certificate, key, chain and risk.
  • 39. validate complete chain: Record the affected service, certificate, key, chain and risk.
  • 40. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
  • 41. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
  • 42. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
  • 43. explain revocation model: Record the affected service, certificate, key, chain and risk.
  • 44. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
05 / 06

Practice Appendix: PFS and Key Exchange Review

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. Forward Secrecy und Key Exchange

  • Task: check certificate and SAN and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. TLS

  • Task: review private-key protection and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. X.509

  • Task: validate complete chain and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. Security

  • Task: review TLS version and cipher policy and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. Forward Secrecy und Key Exchange

  • Task: document trust-store assumption and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. TLS

  • Task: check expiration date and renewal path and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. X.509

  • Task: explain revocation model and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. Security

  • Task: evaluate mTLS identity and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. Forward Secrecy und Key Exchange

  • Task: mark HSTS or header risk and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. TLS

  • Task: name monitoring or alert rule and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. X.509

  • Task: record incident recovery path and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. Security

  • Task: write team rule and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. Forward Secrecy und Key Exchange

  • Task: check certificate and SAN and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. TLS

  • Task: review private-key protection and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. X.509

  • Task: validate complete chain and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. Security

  • Task: review TLS version and cipher policy and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. Forward Secrecy und Key Exchange

  • Task: document trust-store assumption and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. TLS

  • Task: check expiration date and renewal path and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. X.509

  • Task: explain revocation model and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. Security

  • Task: evaluate mTLS identity and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. Forward Secrecy und Key Exchange

  • Task: mark HSTS or header risk and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. TLS

  • Task: name monitoring or alert rule and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. X.509

  • Task: record incident recovery path and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. Security

  • Task: write team rule and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. Forward Secrecy und Key Exchange

  • Task: check certificate and SAN and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. TLS

  • Task: review private-key protection and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. X.509

  • Task: validate complete chain and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. Security

  • Task: review TLS version and cipher policy and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. Forward Secrecy und Key Exchange

  • Task: document trust-store assumption and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. TLS

  • Task: check expiration date and renewal path and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. X.509

  • Task: explain revocation model and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. Security

  • Task: evaluate mTLS identity and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. Forward Secrecy und Key Exchange

  • Task: mark HSTS or header risk and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. TLS

  • Task: name monitoring or alert rule and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. X.509

  • Task: record incident recovery path and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. Security

  • Task: write team rule and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. Forward Secrecy und Key Exchange

  • Task: check certificate and SAN and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. TLS

  • Task: review private-key protection and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. X.509

  • Task: validate complete chain and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. Security

  • Task: review TLS version and cipher policy and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. Forward Secrecy und Key Exchange

  • Task: document trust-store assumption and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. TLS

  • Task: check expiration date and renewal path and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. X.509

  • Task: explain revocation model and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. Security

  • Task: evaluate mTLS identity and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. Forward Secrecy und Key Exchange

  • Task: mark HSTS or header risk and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. TLS

  • Task: name monitoring or alert rule and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. X.509

  • Task: record incident recovery path and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. Security

  • Task: write team rule and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. Forward Secrecy und Key Exchange

  • Task: check certificate and SAN and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. TLS

  • Task: review private-key protection and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A051. X.509

  • Task: validate complete chain and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A052. Security

  • Task: review TLS version and cipher policy and connect the observation explicitly to Security.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A053. Forward Secrecy und Key Exchange

  • Task: document trust-store assumption and connect the observation explicitly to Forward Secrecy und Key Exchange.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A054. TLS

  • Task: check expiration date and renewal path and connect the observation explicitly to TLS.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A055. X.509

  • Task: explain revocation model and connect the observation explicitly to X.509.
  • Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
  • Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
  • Security question: Which keys, certificates, chains, trust stores or headers would be critical?
  • Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.
06 / 06

TLS · Orthevs Academy

31 modules as one continuous learning path.

The sequence remains unchanged: from the lab skeleton through technical foundations and operating models to final troubleshooting. The technical directory names are deliberately preserved.

Practice modules

Orthevs as an app

Install Orthevs

The Orthevs web app can be installed on supported mobile devices and desktop browsers.

iPhone and iPad

Open Orthevs in Safari. Tap Share, then Add to Home Screen. Enable Open as Web App if offered, then tap Add.

Android

For the web app, open the browser menu and choose Install app or Add to Home screen. Confirm the installation.

Desktop browser

Open the browser menu or the install icon in the address bar, then choose Install app or Add to Dock.

Web app installation depends on your browser. If no install prompt appears, follow the browser steps shown above.