Submission Format

• OpenSSL configuration or patch
• generated test artifacts only from work/
• commands executed
• certificate or chain excerpt
• short risk and recovery note

Tasks

Task 01: TLS

Build or improve a TLS artifact focused on TLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 02: X.509

Build or improve a TLS artifact focused on X.509.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 03: CSR

Build or improve a TLS artifact focused on CSR.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 04: SAN

Build or improve a TLS artifact focused on SAN.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 05: Chain

Build or improve a TLS artifact focused on Chain.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 06: Cipher

Build or improve a TLS artifact focused on Cipher.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 07: ACME

Build or improve a TLS artifact focused on ACME.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 08: mTLS

Build or improve a TLS artifact focused on mTLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 09: Revocation

Build or improve a TLS artifact focused on Revocation.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 10: Monitoring

Build or improve a TLS artifact focused on Monitoring.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 11: TLS

Build or improve a TLS artifact focused on TLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 12: X.509

Build or improve a TLS artifact focused on X.509.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 13: CSR

Build or improve a TLS artifact focused on CSR.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 14: SAN

Build or improve a TLS artifact focused on SAN.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 15: Chain

Build or improve a TLS artifact focused on Chain.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 16: Cipher

Build or improve a TLS artifact focused on Cipher.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 17: ACME

Build or improve a TLS artifact focused on ACME.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 18: mTLS

Build or improve a TLS artifact focused on mTLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 19: Revocation

Build or improve a TLS artifact focused on Revocation.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 20: Monitoring

Build or improve a TLS artifact focused on Monitoring.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 21: TLS

Build or improve a TLS artifact focused on TLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 22: X.509

Build or improve a TLS artifact focused on X.509.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 23: CSR

Build or improve a TLS artifact focused on CSR.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 24: SAN

Build or improve a TLS artifact focused on SAN.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 25: Chain

Build or improve a TLS artifact focused on Chain.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 26: Cipher

Build or improve a TLS artifact focused on Cipher.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 27: ACME

Build or improve a TLS artifact focused on ACME.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 28: mTLS

Build or improve a TLS artifact focused on mTLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 29: Revocation

Build or improve a TLS artifact focused on Revocation.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 30: Monitoring

Build or improve a TLS artifact focused on Monitoring.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 31: TLS

Build or improve a TLS artifact focused on TLS.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 32: X.509

Build or improve a TLS artifact focused on X.509.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 33: CSR

Build or improve a TLS artifact focused on CSR.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 34: SAN

Build or improve a TLS artifact focused on SAN.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 35: Chain

Build or improve a TLS artifact focused on Chain.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Task 36: Cipher

Build or improve a TLS artifact focused on Cipher.

Requirements:

• do not use production keys
• check SAN, validity and key usage
• document chain or trust assumption
• name an error or abuse path

Evidence:

openssl x509 -in work/certs/server.crt -noout -text
openssl verify -CAfile work/ca/root.crt work/certs/server.crt

Solution Notes

Use local test CAs, short validity and explicit SANs. Review not only certificate syntax but also chain, trust, key protection and recovery.

Review Checklist for Exercises Advanced Security

• 01. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 02. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 03. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 04. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 05. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 06. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 07. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 08. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 09. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 10. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 11. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 12. write team rule: Record the affected service, certificate, key, chain and risk.
• 13. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 14. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 15. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 16. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 17. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 18. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 19. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 20. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 21. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 22. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 23. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 24. write team rule: Record the affected service, certificate, key, chain and risk.
• 25. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 26. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 27. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 28. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 29. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 30. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 31. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 32. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 33. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 34. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 35. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 36. write team rule: Record the affected service, certificate, key, chain and risk.
• 37. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 38. review private-key protection: Record the affected service, certificate, key, chain and risk.
• 39. validate complete chain: Record the affected service, certificate, key, chain and risk.
• 40. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
• 41. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
• 42. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
• 43. explain revocation model: Record the affected service, certificate, key, chain and risk.
• 44. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
• 45. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
• 46. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
• 47. record incident recovery path: Record the affected service, certificate, key, chain and risk.
• 48. write team rule: Record the affected service, certificate, key, chain and risk.
• 49. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
• 50. review private-key protection: Record the affected service, certificate, key, chain and risk.

Practice Appendix: Exercises Advanced Security

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. CSR

• Task: validate complete chain and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. SAN

• Task: review TLS version and cipher policy and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. Chain

• Task: document trust-store assumption and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. Cipher

• Task: check expiration date and renewal path and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. ACME

• Task: explain revocation model and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. mTLS

• Task: evaluate mTLS identity and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. Revocation

• Task: mark HSTS or header risk and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. Monitoring

• Task: name monitoring or alert rule and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. TLS

• Task: record incident recovery path and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. X.509

• Task: write team rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. CSR

• Task: check certificate and SAN and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. SAN

• Task: review private-key protection and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. Cipher

• Task: review TLS version and cipher policy and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. ACME

• Task: document trust-store assumption and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. mTLS

• Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. Revocation

• Task: explain revocation model and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. Monitoring

• Task: evaluate mTLS identity and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. CSR

• Task: record incident recovery path and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. SAN

• Task: write team rule and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. Chain

• Task: check certificate and SAN and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. Cipher

• Task: review private-key protection and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. ACME

• Task: validate complete chain and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. mTLS

• Task: review TLS version and cipher policy and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. Revocation

• Task: document trust-store assumption and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. Monitoring

• Task: check expiration date and renewal path and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. TLS

• Task: explain revocation model and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. X.509

• Task: evaluate mTLS identity and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. CSR

• Task: mark HSTS or header risk and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. SAN

• Task: name monitoring or alert rule and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. Chain

• Task: record incident recovery path and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. Cipher

• Task: write team rule and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. ACME

• Task: check certificate and SAN and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. mTLS

• Task: review private-key protection and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. Revocation

• Task: validate complete chain and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. Monitoring

• Task: review TLS version and cipher policy and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. TLS

• Task: document trust-store assumption and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. X.509

• Task: check expiration date and renewal path and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. CSR

• Task: explain revocation model and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. SAN

• Task: evaluate mTLS identity and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. Chain

• Task: mark HSTS or header risk and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. Cipher

• Task: name monitoring or alert rule and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. ACME

• Task: record incident recovery path and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. mTLS

• Task: write team rule and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. Revocation

• Task: check certificate and SAN and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. Monitoring

• Task: review private-key protection and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A051. TLS

• Task: validate complete chain and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A052. X.509

• Task: review TLS version and cipher policy and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A053. CSR

• Task: document trust-store assumption and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A054. SAN

• Task: check expiration date and renewal path and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A055. Chain

• Task: explain revocation model and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A056. Cipher

• Task: evaluate mTLS identity and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A057. ACME

• Task: mark HSTS or header risk and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A058. mTLS

• Task: name monitoring or alert rule and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A059. Revocation

• Task: record incident recovery path and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A060. Monitoring

• Task: write team rule and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A061. TLS

• Task: check certificate and SAN and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A062. X.509

• Task: review private-key protection and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A063. CSR

• Task: validate complete chain and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A064. SAN

• Task: review TLS version and cipher policy and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A065. Chain

• Task: document trust-store assumption and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A066. Cipher

• Task: check expiration date and renewal path and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A067. ACME

• Task: explain revocation model and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A068. mTLS

• Task: evaluate mTLS identity and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A069. Revocation

• Task: mark HSTS or header risk and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A070. Monitoring

• Task: name monitoring or alert rule and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A071. TLS

• Task: record incident recovery path and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A072. X.509

• Task: write team rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A073. CSR

• Task: check certificate and SAN and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A074. SAN

• Task: review private-key protection and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A075. Chain

• Task: validate complete chain and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A076. Cipher

• Task: review TLS version and cipher policy and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A077. ACME

• Task: document trust-store assumption and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A078. mTLS

• Task: check expiration date and renewal path and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A079. Revocation

• Task: explain revocation model and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A080. Monitoring

• Task: evaluate mTLS identity and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A081. TLS

• Task: mark HSTS or header risk and connect the observation explicitly to TLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A082. X.509

• Task: name monitoring or alert rule and connect the observation explicitly to X.509.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A083. CSR

• Task: record incident recovery path and connect the observation explicitly to CSR.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A084. SAN

• Task: write team rule and connect the observation explicitly to SAN.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A085. Chain

• Task: check certificate and SAN and connect the observation explicitly to Chain.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A086. Cipher

• Task: review private-key protection and connect the observation explicitly to Cipher.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A087. ACME

• Task: validate complete chain and connect the observation explicitly to ACME.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A088. mTLS

• Task: review TLS version and cipher policy and connect the observation explicitly to mTLS.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A089. Revocation

• Task: document trust-store assumption and connect the observation explicitly to Revocation.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A090. Monitoring

• Task: check expiration date and renewal path and connect the observation explicitly to Monitoring.
• Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which keys, certificates, chains, trust stores or headers would be critical?
• Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.