TLS Workshop – Overview · TLS

Overview

This workshop covers the path from TLS and X.509 fundamentals to ACME, mTLS, certificate monitoring, hardening and incident response.

The focus is on:

TLS 1.2, TLS 1.3 and secure protocol policy
X.509 certificates, CSRs, SANs, key usage and chains
OpenSSL analysis, trust stores and hostname validation
ACME, renewal, web server TLS and Kubernetes ingress
mTLS, service identities and platform operations
revocation, CT, HSTS, monitoring and key-compromise recovery

Quickstart

# Workshop content is provided through the Orthevs Academy.
chmod +x scripts/provision_tls.sh
./scripts/provision_tls.sh --dry-run
./examples/00-lab-skeleton/run.sh

Audience

Developers, administrators, DevOps engineers, SREs, platform engineers, cloud engineers, security engineers and everyone who operates, debugs or secures TLS connections.

Learning Path

Level	Focus	Outcome
Fundamentals	TLS-Grundlagen, SSL-Abgrenzung, Zertifikate, Keys, CAs, SANs, Trust und erste OpenSSL-Analyse	You can explain, locally check and review the related TLS patterns.
Intermediate	Handshake, TLS 1.2/1.3, Cipher Suites, Chain-Building, CSR, Webserver und Debugging	You can explain, locally check and review the related TLS patterns.
Professional	ACME, Automatisierung, Kubernetes Ingress, cert-manager, mTLS, Monitoring und Enterprise PKI	You can explain, locally check and review the related TLS patterns.
Advanced Security	Hardening, Revocation, CT, HSTS, Legacy-Abbau, TLS Inspection, Key Compromise und Incident Response	You can explain, locally check and review the related TLS patterns.

Structure

Workshop Structure

.
├── assessments/
├── docs/
├── examples/
├── exercises/
├── media/
├── scripts/
├── workshops/
├── LICENSE.md
└── README-EN.md

Prerequisites

Linux, macOS or WSL
OpenSSL
curl
Git
Python 3
optional NGINX, Apache, testssl.sh, cert-manager or Kubernetes for real platform labs

Official and Technical Documentation

Working Mode

Do not use production private keys, certificates or customer domains in labs.
Test keys and certificates are created only below work/ and are not committed.
External scans require explicit authorization.
CA, trust-store, HSTS and mTLS changes are documented and justified.

Sources and References

Review Checklist for the Workshop

01. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
02. review private-key protection: Record the affected service, certificate, key, chain and risk.
03. validate complete chain: Record the affected service, certificate, key, chain and risk.
04. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
05. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
06. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
07. explain revocation model: Record the affected service, certificate, key, chain and risk.
08. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
09. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
10. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
11. record incident recovery path: Record the affected service, certificate, key, chain and risk.
12. write team rule: Record the affected service, certificate, key, chain and risk.
13. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
14. review private-key protection: Record the affected service, certificate, key, chain and risk.
15. validate complete chain: Record the affected service, certificate, key, chain and risk.
16. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
17. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
18. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
19. explain revocation model: Record the affected service, certificate, key, chain and risk.
20. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
21. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
22. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
23. record incident recovery path: Record the affected service, certificate, key, chain and risk.
24. write team rule: Record the affected service, certificate, key, chain and risk.
25. check certificate and SAN: Record the affected service, certificate, key, chain and risk.
26. review private-key protection: Record the affected service, certificate, key, chain and risk.
27. validate complete chain: Record the affected service, certificate, key, chain and risk.
28. review TLS version and cipher policy: Record the affected service, certificate, key, chain and risk.
29. document trust-store assumption: Record the affected service, certificate, key, chain and risk.
30. check expiration date and renewal path: Record the affected service, certificate, key, chain and risk.
31. explain revocation model: Record the affected service, certificate, key, chain and risk.
32. evaluate mTLS identity: Record the affected service, certificate, key, chain and risk.
33. mark HSTS or header risk: Record the affected service, certificate, key, chain and risk.
34. name monitoring or alert rule: Record the affected service, certificate, key, chain and risk.
35. record incident recovery path: Record the affected service, certificate, key, chain and risk.
36. write team rule: Record the affected service, certificate, key, chain and risk.

Practice Appendix: Workshop

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSL artifacts, sample configurations and a Git repository.

A001. TLS

Task: check certificate and SAN and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A002. X.509

Task: review private-key protection and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A003. PKI

Task: validate complete chain and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A004. Monitoring

Task: review TLS version and cipher policy and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A005. Security

Task: document trust-store assumption and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A006. TLS

Task: check expiration date and renewal path and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A007. X.509

Task: explain revocation model and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A008. PKI

Task: evaluate mTLS identity and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A009. Monitoring

Task: mark HSTS or header risk and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A010. Security

Task: name monitoring or alert rule and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A011. TLS

Task: record incident recovery path and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A012. X.509

Task: write team rule and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A013. PKI

Task: check certificate and SAN and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A014. Monitoring

Task: review private-key protection and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A015. Security

Task: validate complete chain and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A016. TLS

Task: review TLS version and cipher policy and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A017. X.509

Task: document trust-store assumption and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A018. PKI

Task: check expiration date and renewal path and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A019. Monitoring

Task: explain revocation model and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A020. Security

Task: evaluate mTLS identity and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A021. TLS

Task: mark HSTS or header risk and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A022. X.509

Task: name monitoring or alert rule and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A023. PKI

Task: record incident recovery path and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A024. Monitoring

Task: write team rule and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A025. Security

Task: check certificate and SAN and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A026. TLS

Task: review private-key protection and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A027. X.509

Task: validate complete chain and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A028. PKI

Task: review TLS version and cipher policy and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A029. Monitoring

Task: document trust-store assumption and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A030. Security

Task: check expiration date and renewal path and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A031. TLS

Task: explain revocation model and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A032. X.509

Task: evaluate mTLS identity and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A033. PKI

Task: mark HSTS or header risk and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A034. Monitoring

Task: name monitoring or alert rule and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A035. Security

Task: record incident recovery path and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A036. TLS

Task: write team rule and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A037. X.509

Task: check certificate and SAN and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A038. PKI

Task: review private-key protection and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A039. Monitoring

Task: validate complete chain and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A040. Security

Task: review TLS version and cipher policy and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A041. TLS

Task: document trust-store assumption and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A042. X.509

Task: check expiration date and renewal path and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A043. PKI

Task: explain revocation model and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A044. Monitoring

Task: evaluate mTLS identity and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A045. Security

Task: mark HSTS or header risk and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A046. TLS

Task: name monitoring or alert rule and connect the observation explicitly to TLS.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A047. X.509

Task: record incident recovery path and connect the observation explicitly to X.509.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A048. PKI

Task: write team rule and connect the observation explicitly to PKI.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A049. Monitoring

Task: check certificate and SAN and connect the observation explicitly to Monitoring.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.

A050. Security

Task: review private-key protection and connect the observation explicitly to Security.
Evidence: Record at least one OpenSSL- or curl-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which keys, certificates, chains, trust stores or headers would be critical?
Recovery: Describe whether reissue, renewal, revocation, trust-store repair, rollback or key rotation would be needed.