Secrets, PKI & Certificate Management for Infrastructure Engineers

Part I

Secrets and Identity Foundations

What counts as a secret, the configuration/secret boundary, human versus machine versus workload identity, a credential taxonomy, blast radius, and where credentials actually leak.

6 lessons

Part II

The Secret Lifecycle

Generate, distribute, use, store, rotate, revoke and destroy; safe generation and entropy; distribution without proliferation; and the storage anti-patterns that dominate real incidents.

6 lessons

Part III

Cryptography for Infrastructure Engineers

Symmetric and asymmetric cryptography, hashes, MACs, digital signatures, entropy and key derivation, and envelope encryption - to operator depth, never implementation depth.

7 lessons

Part IV

PKI Foundations

Trust anchors, root and intermediate and leaf, path building and validation, public Web PKI versus internal PKI, offline root operations, and intermediate CA design for blast-radius control.

7 lessons

Part V

X.509 Certificates in Depth

The fields operators use, the extensions that decide behaviour, Subject Alternative Name and the end of Common Name matching, CSRs and what they prove, and key-to-certificate correspondence.

6 lessons

Part VI

Chains and Trust Stores

How a chain is assembled and presented, the missing intermediate, OS and language and container trust stores, distributing a private trust anchor, and diagnosing client-specific trust failures.

6 lessons

Part VII

TLS for Operators

What TLS actually provides, the TLS 1.3 handshake, how TLS 1.2 differs, certificate validation as the client performs it, version and cipher policy, and mutual TLS.

6 lessons

Part VIII

TLS Troubleshooting

Evidence-first methodology, openssl s_client and curl as instruments, the classic failure signatures, clock skew, and why disabling verification is never the fix.

6 lessons

Part IX

Certificate Lifecycle and Revocation

Expiry as an availability incident, renewal windows and overlap, deployment and reload, key rotation versus renewal, CRL and OCSP mechanics, and what revocation really achieves.

7 lessons

Part X

ACME and Certificate Automation

The ACME order flow, HTTP-01 and DNS-01 and TLS-ALPN-01, Let's Encrypt staging and rate limits, internal ACME from a private CA, and renewal automation you can trust.

6 lessons

Part XI

SSH Keys, Host Trust and SSH CAs

Public-key authentication, host keys and trust on first use, investigating a changed host key, the agent and forwarding risks, and SSH certificate authorities with principals and revocation.

6 lessons

Part XII

Secret Management Platforms

Secret-manager architecture before any product, storage and barrier and seal, static secrets, least-privilege policy, tokens and authentication methods, and audit that does not leak.

6 lessons

Part XIII

Dynamic Credentials and Workload Identity

Credentials created on demand, leases and TTL trade-offs, machine authentication methods, the secret-zero problem, platform-attested workload identity, and SPIFFE/SPIRE scope and cost.

6 lessons

Part XIV

Platform Integration

Kubernetes secrets and cluster PKI and certificate incidents, container build secrets and image layers, Terraform state exposure, Ansible vault and no_log limits, CI/CD OIDC federation, and database and network-device patterns.

7 lessons

Part XV

KMS, HSM and Key Protection

The operations you delegate to a KMS, envelope encryption in practice, non-exportable keys in hardware, what KMS key rotation actually changes, key backup, and quorum-controlled root key recovery.

6 lessons

Part XVI

Rotation Without Outage

Why instant replacement causes outages, the dual-credential pattern, zero-downtime database password rotation, fleet certificate and key rotation, intermediate CA rotation, and trust-anchor migration.

6 lessons

Part XVII

Inventory, Discovery and Monitoring

You cannot rotate what you do not know exists: building a credential inventory, discovering certificates across an estate, expiry monitoring, secret-manager observability, and alert design.

6 lessons

Part XVIII

Incidents and Recovery

The first hour after exposure, private key compromise, CA compromise as a different class of incident, compromised CI and cloud and SSH credentials, secret-manager outage, and backup and disaster recovery.

7 lessons

Part XIX

Production Architecture

Trust boundaries, least privilege for retrieving a secret versus using a key, what belongs in Git, and reference architectures for internal PKI, workload secrets, and delivery-pipeline identity.

6 lessons

Part Labs

Labs

Hands-on disposable-environment labs covering certificate inspection and issuance, CA construction, TLS and mutual TLS, chain and trust-store diagnosis, ACME automation, SSH certificate authorities, secret-manager operation, dynamic credentials, rotation, monitoring and recovery.

0 lessons

Part Runbooks

Runbooks

Operational procedures for certificate expiry and renewal, TLS and chain and mutual-TLS troubleshooting, key and credential rotation, revocation, leaked-secret and compromised-key response, secret-manager recovery, and PKI restoration.

0 lessons

Part Checklists

Checklists

Production readiness reviews for secret management, internal PKI, TLS services, certificate issuance and renewal, ACME automation, SSH trust, rotation, CA security, KMS and HSM, platform integration, and disaster recovery.

0 lessons

Part Breakfix

Break/Fix Scenarios

Evidence-first diagnosis of certificate, chain, trust-store, TLS, ACME, SSH, secret-manager, dynamic-credential, leakage and compromise failure modes, each reproduced against real software.

0 lessons

Part Capstone

Production Capstone

Design and build a complete secrets and PKI architecture: trust hierarchy, automated issuance, SSH identity, least-privilege secret management, short-lived credentials, workload identity, monitoring, rotation, compromise response and proven recovery.

1 lesson

Part Final

Final Assessment

Final theory assessment plus final practical assessment of an inherited estate with realistic credential, certificate and trust defects.

0 lessons