Submission Format

• OpenSSL configuration or patch
• generated test artifacts only from work/
• commands executed
• certificate or chain excerpt
• short risk and recovery note

Tasks

Task 01: TLS

Build or improve a TLS artifact focused on TLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 02: X.509

Build or improve a TLS artifact focused on X.509.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 03: CSR

Build or improve a TLS artifact focused on CSR.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 04: SAN

Build or improve a TLS artifact focused on SAN.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 05: Chain

Build or improve a TLS artifact focused on Chain.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 06: Cipher

Build or improve a TLS artifact focused on Cipher.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 07: ACME

Build or improve a TLS artifact focused on ACME.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 08: mTLS

Build or improve a TLS artifact focused on mTLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 09: Revocation

Build or improve a TLS artifact focused on Revocation.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 10: Monitoring

Build or improve a TLS artifact focused on Monitoring.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 11: TLS

Build or improve a TLS artifact focused on TLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 12: X.509

Build or improve a TLS artifact focused on X.509.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 13: CSR

Build or improve a TLS artifact focused on CSR.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 14: SAN

Build or improve a TLS artifact focused on SAN.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 15: Chain

Build or improve a TLS artifact focused on Chain.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 16: Cipher

Build or improve a TLS artifact focused on Cipher.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 17: ACME

Build or improve a TLS artifact focused on ACME.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 18: mTLS

Build or improve a TLS artifact focused on mTLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 19: Revocation

Build or improve a TLS artifact focused on Revocation.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 20: Monitoring

Build or improve a TLS artifact focused on Monitoring.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 21: TLS

Build or improve a TLS artifact focused on TLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 22: X.509

Build or improve a TLS artifact focused on X.509.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 23: CSR

Build or improve a TLS artifact focused on CSR.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 24: SAN

Build or improve a TLS artifact focused on SAN.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 25: Chain

Build or improve a TLS artifact focused on Chain.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 26: Cipher

Build or improve a TLS artifact focused on Cipher.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 27: ACME

Build or improve a TLS artifact focused on ACME.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 28: mTLS

Build or improve a TLS artifact focused on mTLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 29: Revocation

Build or improve a TLS artifact focused on Revocation.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 30: Monitoring

Build or improve a TLS artifact focused on Monitoring.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 31: TLS

Build or improve a TLS artifact focused on TLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 32: X.509

Build or improve a TLS artifact focused on X.509.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 33: CSR

Build or improve a TLS artifact focused on CSR.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 34: SAN

Build or improve a TLS artifact focused on SAN.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 35: Chain

Build or improve a TLS artifact focused on Chain.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 36: Cipher

Build or improve a TLS artifact focused on Cipher.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Solution Notes

Use local test CAs, short validity and explicit SANs. Review not only certificate syntax but also chain, trust, key protection and recovery.

Review Checklist for Exercises Intermediate

• 01. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 02. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 03. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 04. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 05. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 06. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 07. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 08. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 09. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 10. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 11. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 12. write team rule: Record the affected service, certificate, key, chain and risk.
• 13. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 14. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 15. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 16. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 17. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 18. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 19. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 20. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 21. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 22. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 23. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 24. write team rule: Record the affected service, certificate, key, chain and risk.
• 25. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 26. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 27. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 28. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 29. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 30. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 31. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 32. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 33. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 34. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 35. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 36. write team rule: Record the affected service, certificate, key, chain and risk.
• 37. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 38. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 39. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 40. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 41. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 42. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 43. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 44. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 45. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 46. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 47. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 48. write team rule: Record the affected service, certificate, key, chain and risk.
• 49. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 50. review private-key protection: Record the affected service, certificate, key, chain and risk.

Practice Appendix: Exercises Intermediate

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. CSR

• Task: validate complete chain and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. SAN

• Task: review TLS version and cipher policy and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. Chain

• Task: document trust-store assumption and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. Cipher

• Task: check expiration date and renewal path and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. ACME

• Task: explain revocation model and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. mTLS

• Task: evaluate mTLS identity and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. Revocation

• Task: mark HSTS or header risk and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. Monitoring

• Task: name monitoring or alert rule and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. TLS

• Task: record incident recovery path and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. X.509

• Task: write team rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. CSR

• Task: check certificate and SAN and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. SAN

• Task: review private-key protection and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. Cipher

• Task: review TLS version and cipher policy and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. ACME

• Task: document trust-store assumption and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. mTLS

• Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. Revocation

• Task: explain revocation model and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. Monitoring

• Task: evaluate mTLS identity and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. CSR

• Task: record incident recovery path and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. SAN

• Task: write team rule and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. Chain

• Task: check certificate and SAN and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. Cipher

• Task: review private-key protection and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. ACME

• Task: validate complete chain and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. mTLS

• Task: review TLS version and cipher policy and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. Revocation

• Task: document trust-store assumption and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. Monitoring

• Task: check expiration date and renewal path and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. TLS

• Task: explain revocation model and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. X.509

• Task: evaluate mTLS identity and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. CSR

• Task: mark HSTS or header risk and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. SAN

• Task: name monitoring or alert rule and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. Cipher

• Task: write team rule and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. ACME

• Task: check certificate and SAN and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. mTLS

• Task: review private-key protection and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. Revocation

• Task: validate complete chain and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. Monitoring

• Task: review TLS version and cipher policy and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. CSR

• Task: explain revocation model and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. SAN

• Task: evaluate mTLS identity and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. Chain

• Task: mark HSTS or header risk and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. Cipher

• Task: name monitoring or alert rule and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. ACME

• Task: record incident recovery path and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. mTLS

• Task: write team rule and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. Revocation

• Task: check certificate and SAN and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. Monitoring

• Task: review private-key protection and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A051. TLS

• Task: validate complete chain and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A052. X.509

• Task: review TLS version and cipher policy and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A053. CSR

• Task: document trust-store assumption and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A054. SAN

• Task: check expiration date and renewal path and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A055. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A056. Cipher

• Task: evaluate mTLS identity and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A057. ACME

• Task: mark HSTS or header risk and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A058. mTLS

• Task: name monitoring or alert rule and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A059. Revocation

• Task: record incident recovery path and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A060. Monitoring

• Task: write team rule and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A061. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A062. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A063. CSR

• Task: validate complete chain and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A064. SAN

• Task: review TLS version and cipher policy and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A065. Chain

• Task: document trust-store assumption and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A066. Cipher

• Task: check expiration date and renewal path and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A067. ACME

• Task: explain revocation model and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A068. mTLS

• Task: evaluate mTLS identity and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A069. Revocation

• Task: mark HSTS or header risk and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A070. Monitoring

• Task: name monitoring or alert rule and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A071. TLS

• Task: record incident recovery path and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A072. X.509

• Task: write team rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A073. CSR

• Task: check certificate and SAN and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A074. SAN

• Task: review private-key protection and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A075. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A076. Cipher

• Task: review TLS version and cipher policy and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A077. ACME

• Task: document trust-store assumption and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A078. mTLS

• Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A079. Revocation

• Task: explain revocation model and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A080. Monitoring

• Task: evaluate mTLS identity and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A081. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A082. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A083. CSR

• Task: record incident recovery path and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A084. SAN

• Task: write team rule and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A085. Chain

• Task: check certificate and SAN and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A086. Cipher

• Task: review private-key protection and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A087. ACME

• Task: validate complete chain and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A088. mTLS

• Task: review TLS version and cipher policy and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A089. Revocation

• Task: document trust-store assumption and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A090. Monitoring

• Task: check expiration date and renewal path and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.