Secrets, PKI & Certificates · Self-assessment
Knowledge checks
Every knowledge check in this course, in curriculum order. Each link opens the page at its quiz. The questions are auto-graded in the browser and nothing is recorded — a wrong answer costs you only the explanation, which is the part worth reading.
- Knowledge checks
- 120
- Parts covered
- 20
- Of all lessons
- 100%
Part I
Secrets and Identity Foundations
6 checks
- What actually counts as a secretA working test that separates a secret from configuration, applied to the values that resist it: a database hostname, a connection string, an internal URL, a public key and a server certificate.→
- The six questions that govern every credentialA repeatable analysis for any credential you meet: who is trusted, what proves it, who issued it, where the private material lives, how long it lives, and what actually enforces revocation.→
- Human identity, machine identity and workload identityThree principals with three incompatible constraints, and why a credential pattern designed around a person fails when the holder is a host that never sleeps or a container that lives for forty seconds.→
- A working taxonomy of infrastructure credentialsEight credential classes an infrastructure engineer meets in practice, each described by where the sensitive half lives, what issues it, what it unlocks, and how rotation actually works for that class.→
- Blast radius: what one credential unlocksHow to compute what an attacker gains from a single stolen credential, why the transitive edges matter more than the direct grants, and the four levers that shrink the answer.→
- Where credentials really leakAn evidence-based inventory of the channels that actually disclose secrets in production estates: repository history, pipeline logs, state files, image layers, platform stores and human channels.→
Part II
The Secret Lifecycle
6 checks
- The secret lifecycle - seven stages and seven ownersThe seven stages every credential passes through, the artefact each stage produces, and the precise operational failure that appears when a stage has nobody accountable for it.→
- Generating secrets safely - entropy, strength and the folkloreHow the Linux kernel supplies random bytes, why the urandom folklore is wrong, what actually makes a generated secret strong, and the generation mistakes that still pass code review.→
- Distribution without proliferation - counting the copiesHow a secret travels from its source of truth to the process that needs it, why every transport mechanism manufactures copies, and an honest comparison of the six delivery patterns in production use.→
- Storage anti-patterns I - repositories, images, state and inventoriesFour artefacts that persist credentials in ways their obvious remediation does not undo: the Git repository, the container image, the infrastructure state file, and the encrypted inventory.→
- Storage anti-patterns II - logs, the environment, the process table and peopleWhy CI log masking is documented as best effort, what actually exposes an environment variable and when it is a defensible choice, why the process table is the worst carrier of all, and the unadministered stores humans keep.→
- Ownership, expiry and destruction - closing the lifecycleHow to test whether a credential really has an owner, why expiry is the only control that operates unattended, what deletion does not reach, and the preconditions cryptographic erasure actually requires.→
Part III
Cryptography for Infrastructure Engineers
7 checks
- What "encrypted" actually promises, and the vocabulary that carries itConfidentiality, integrity, authenticity and freshness are four separate properties bought by four different mechanisms. This lesson gives you the vocabulary to say which one you have and which one you still need.→
- Symmetric encryption in infrastructure, and why AEAD is the only sane defaultSymmetric ciphers protect almost every byte your estate stores or transmits. This lesson covers where they are used, why the mode matters more than the cipher, and what authenticated encryption changes operationally.→
- Key pairs, signing and key agreement: what a public key is actually forA key pair separates the ability to prove from the ability to check. This lesson covers the three distinct jobs asymmetric cryptography does in infrastructure and dismantles the idea that it encrypts your traffic.→
- Hashes, MACs and HMAC: integrity is not authenticityA checksum tells you bytes did not change by accident. A keyed MAC tells you who produced them. This lesson separates the two, explains why HMAC has the shape it does, and shows where the distinction causes production incidents.→
- Digital signatures end to end: what is signed, by which key, and what a verifier learnsA signature is a claim about a precise sequence of bytes made by a holder of one private key. This lesson traces the whole path, from canonical bytes to trust policy, across certificates, SSH, Git and artifact signing.→
- Entropy, random number generation and key derivation on modern LinuxEvery key, nonce, salt and session identifier starts as randomness. This lesson covers what the kernel actually provides today, the boot and cloning failures that break it, and the two very different jobs a key derivation function does.→
- Envelope encryption and the key hierarchy: why KEK and DEK are everywhereWrapping a local data key with a remote key encryption key is the pattern behind cloud storage encryption, Kubernetes secret encryption and every sealed secret manager. This lesson explains the mechanism, the rotation semantics and the new dependencies it creates.→
Part IV
PKI Foundations
7 checks
- What a public key infrastructure is actually forEstablishes the problem a PKI solves: binding a name to a public key so that a stranger can check the binding offline, in milliseconds, without contacting anyone who vouched for it.→
- Trust anchors: where a client's trust physically livesShows that trusting a CA is not an attitude but a configured input to path validation, locates the files and stores that hold it on a real host, and explains what adding an anchor actually grants.→
- Root, intermediate and leaf: why the middle layer existsExplains what distinguishes the three certificate roles in the encoding, why almost every real PKI puts an issuing CA between the anchor and the leaf, and what that middle layer costs at deployment time.→
- Certification path building and path validationSeparates the search that assembles a candidate chain from the algorithm that checks one, walks the RFC 5280 inputs and basic checks, and maps real verifier error codes onto the phase that produced them.→
- Public Web PKI and internal PKI: two different problemsContrasts a trust model you do not control with one you own entirely, states the CA/Browser Forum constraints that are actually in force today, and warns against copying public numbers into a private CA without the automation to sustain them.→
- Operating a root CA: offline keys, ceremony and honest trade-offsCovers what an offline root actually means, what a signing ceremony produces and why, and gives a direct answer on when the ceremony overhead is justified and when a documented online root is the safer choice.→
- Designing an intermediate CA layout for blast-radius controlTreats the issuing CA as the unit of blast radius, sets out the axes worth separating on, and shows the extensions that turn a diagram into a constraint a verifier will actually enforce.→
Part V
X.509 Certificates in Depth
6 checks
- Reading a certificate: the fields an operator actually usesDecode a real X.509 certificate field by field, learn which values a verifier acts on, and separate the certificate on disk from the certificate a client is actually being served.→
- Extensions that decide behaviour: basicConstraints, keyUsage and extendedKeyUsageHow criticality obliges a verifier to act, what each of the three behavioural extensions causes it to do, and the exact OpenSSL error produced when a certificate is presented for a purpose it was not issued for.→
- Subject Alternative Name and the end of Common Name matchingRFC 9525 removed the Common Name fallback outright. This lesson shows a real certificate with no subject at all, explains why its SAN is marked critical, and separates the verification rule from the issuance rule.→
- Serial numbers, validity windows, signature algorithms and fingerprintsThe four values operators quote most often and understand least. What each one identifies, which of them change on renewal, and how fingerprints are used to pin an identity and to compare two copies of a certificate.→
- Certificate signing requests: what a CSR proves and what it does notA CSR proves possession of one private key at one moment. It proves nothing about entitlement to the name it asks for. This lesson separates the two, and shows what a CA does with the extensions a request asks for.→
- Proving a private key matches a certificateOne digest comparison settles whether a key and a certificate belong together. This lesson explains what is being compared, why it is the first move in several incidents, and what to do when the two values differ.→
Part VI
Chains and Trust Stores
6 checks
- How a certificate chain is assembled, and who supplies which certificateA TLS server sends its own certificate and the CA certificates above it; the client supplies the anchor. This lesson separates the list transmitted on the wire from the certification path the client actually builds.→
- The missing intermediate, the most common TLS failure in productionA server that sends only its leaf produces a verification failure on a certificate that is entirely correct. This lesson reads the exact client errors, proves the fault is delivery rather than material, and explains why some clients never notice.→
- Operating system trust stores on Linux, and how they are updatedWhere the anchor set physically lives on a Linux host, why the file every client reads is generated rather than edited, and how the Debian and Red Hat families differ in the directories, tooling and formats they accept.→
- Application and language trust stores: Java, Python, Node.js, Go and containersMost runtimes do not read the operating system trust store. This lesson maps where Java, Python, Node.js, Go and container images each keep their anchors, which environment variables genuinely change them, and why one host can hold several disagreeing answers.→
- Distributing a private trust anchor across a fleet, and the ordering ruleRolling a private root out to an estate is a two-phase change with a strict order. This lesson covers proving coverage rather than assuming it, the bootstrap problem in the delivery channel, and how an anchor is safely retired at the end of its life.→
- Diagnosing works on my machine but fails in the clusterA methodology for TLS trust failures that reproduce in one place and not another: move the probe to the failure, split the problem with the transmitted chain, and compare a fixed set of variables instead of guessing.→
Part VII
TLS for Operators
6 checks
- What TLS actually provides, and what a certificate really doesSeparate the three guarantees TLS makes from the single job a certificate performs. Session keys come from an ephemeral key exchange; the certificate only binds a name to a public key.→
- The TLS 1.3 handshake, message by messageWalk the RFC 9846 handshake in order, and learn exactly which messages travel in the clear, which are encrypted under handshake traffic keys, and what each one proves.→
- TLS 1.2 versus TLS 1.3, and why the difference reaches your configurationThe changes RFC 9846 lists are not cosmetic. Cipher suite names changed meaning, forward secrecy became structural, and a TLS 1.2 cipher string no longer controls a TLS 1.3 connection.→
- Certificate validation as the client performs itValidation is an ordered set of checks, and each one has its own failure. Learn which check produces which error, why the first failure hides the rest, and how to read a verifier result correctly.→
- Protocol versions, cipher suites and configuration policy in 2026What to enable, what to refuse, and what evidence proves it, grounded in the current BCP 195 documents rather than in a hardening guide someone copied five years ago.→
- Mutual TLS: authenticating the client as well as the serverRequiring a client certificate adds three handshake messages, a second trust store, an extended key usage requirement, and a fleet of short-lived credentials that somebody now has to operate.→
Part VIII
TLS Troubleshooting
6 checks
- Identify the layer before you touch the configurationA repeatable method for TLS failures: separate the five layers a connection passes through, capture evidence from a working and a failing client before changing anything, and name the layer that stopped before proposing a fix.→
- Reading openssl s_client: the five flags that decide what you learnHow to drive openssl s_client deliberately rather than hopefully: what -connect, -servername, -showcerts, -CAfile and -verify_return_error each change, and how to read the depth lines, the chain block and the final verify summary.→
- curl exit 60 and the three different failures behind itWhy curl reports one exit status for several unrelated certificate faults, how to tell a chain delivery problem from a trust store gap when the message is identical, and why the hostname message names the subject alternative name.→
- The classic failures and their exact signaturesA decision table that maps verified verification output to a single cause: expired, wrong hostname, missing intermediate, unknown anchor, unsuitable purpose and version floor, with the depth number as the discriminator between two similar chain errors.→
- Clock skew, validity windows and why a correct certificate fails on one hostValidity is a comparison against a clock, so a credential that every other host accepts can be refused by one machine whose time is wrong. This lesson covers both directions of skew, the credentials beyond TLS that share the fault, and the diagnosis that precedes any renewal.→
- Why disabling verification is not a fixA precise account of what the three commonest escape hatches actually switch off, why an encrypted session to an unverified peer is worth nothing, and the specific correct repair for each of the failure classes that tempt an engineer to reach for them.→
Part IX
Certificate Lifecycle and Revocation
7 checks
- Certificate expiry is an availability incidentTreat notAfter as a scheduled outage with a known date rather than a security event, and learn why the same preventable failure keeps recurring across otherwise well-run estates.→
- Renewal windows, overlapping validity and safe deliverySize a renewal window as a fraction of the lifetime rather than a fixed number of days, use the overlap between old and new certificates deliberately, and move new material onto a host without ever exposing the private key.→
- Deployment and reload: the step that actually breaksA renewed certificate on disk is not a renewed certificate in the running process. This lesson covers where certificates live once a service has started, what a reload really does, and how to prove the swap reached the socket.→
- Rotating a private key versus renewing a certificateRenewal replaces the signed statement; rotation replaces the key pair underneath it. This lesson separates the two operations, shows why reusing a key after suspected compromise hands the attacker a fresh credential, and sequences the swap.→
- Revocation mechanics: CRL and OCSPThe structure of a certificate revocation list, what the reason codes do and do not define, the exact meaning of nextUpdate, and what each of the three OCSP statuses actually asserts about a certificate.→
- What revocation actually achieves in the Web PKISoft-fail, out-of-band revocation sets and the disappearance of public OCSP mean that revoking a certificate does not reliably stop anyone using it. The honest control for a compromised key is a short lifetime and fast reissuance.→
- Revocation inside a private PKIIn a private PKI you own both the publisher and the verifier, so revocation can be made to work. This lesson covers what enforces it, what silently does not, and where delta CRLs and certificateHold genuinely belong.→
Part X
ACME and Certificate Automation
6 checks
- Why manual certificate issuance fails at scaleThe renewal workload of an estate is the certificate count multiplied by the renewal rate, and the industry is shortening lifetimes on a published schedule. This lesson works the arithmetic and names where the human loop breaks.→
- The ACME protocol — accounts, orders, authorizations and the two keysA precise walk through the ACME state transitions from directory to certificate, with the distinction that causes most client bugs: the account key signs every request, and a different key signs the CSR.→
- HTTP-01, DNS-01 and TLS-ALPN-01 — how each one is actually validatedEach ACME challenge proves the same thing over a different transport. This lesson covers what the validator fetches, which network or DNS access each demands, why only DNS-01 issues wildcards, and how the failures read.→
- Let's Encrypt in production — staging, profiles, rate limits and ARIOperating against a public ACME certificate authority means budgeting against token buckets you cannot reset, reading lifetimes from the directory rather than from memory, and letting renewal information schedule the work.→
- Internal ACME — automating issuance from a private certificate authorityACME is a protocol, not a vendor. Putting an ACME endpoint in front of an internal CA removes the ticket, the key handover and the fixed long lifetime, and it is usually the highest-leverage change an internal PKI can make.→
- Designing renewal automation you can trustAutomated renewal has four independent failure points: the order, the reload, the alert and the automation itself. This lesson builds each one as a separate mechanism and proves them from outside the host that runs them.→
Part XI
SSH Keys, Host Trust and SSH CAs
6 checks
- SSH public-key authentication — what actually proves identityHow an SSH client proves possession of a private key, what the signature covers, why authorized_keys is an authorisation list rather than a credential, and which key algorithms survive in OpenSSH 10.→
- Host keys and trust on first use — what TOFU guaranteesHow a server proves its identity during key exchange, what the known_hosts file records, why hashed entries change your tooling, and the precise limit of what accepting a fingerprint once can promise.→
- REMOTE HOST IDENTIFICATION HAS CHANGED — investigate before you deleteThe changed host key warning has three plausible explanations and only one of them is safe to assume. This lesson reads the upstream message precisely, ranks the hypotheses, and covers what each StrictHostKeyChecking value really does.→
- The SSH agent, forwarding, and what a bastion can borrowThe agent turns a key file into a signing service reachable through a socket. Forwarding publishes that socket on a remote host. This lesson covers what an attacker on that host gains, and the alternatives that give it up.→
- SSH certificate authorities — trusting one key instead of thousandsHow an SSH CA replaces authorized_keys distribution and known_hosts prompts with a single trusted key in each direction, what the certificate format actually contains, and which X.509 machinery it deliberately omits.→
- Issuing, constraining and revoking SSH certificatesThe flags that decide who a certificate admits and for how long, the principal rules that changed in OpenSSH 10.3, the difference between a critical option and an extension, and how KRL revocation actually reaches a host.→
Part XII
Secret Management Platforms
6 checks
- The architecture of a secret manager, before any productThe six parts every secret manager implements: client, authentication method, policy, secret engine, credential and audit device. Learn the model once and every product becomes a configuration detail.→
- OpenBao concretely: storage, the barrier, and the unseal ceremonyWhat the barrier encrypts, what the storage backend is allowed to see, and the exact key hierarchy from Shamir share to unseal key to root key to data. Includes a real initialisation and two-share unseal.→
- Static secrets, and why central storage does not solve rotationWhat a key-value secret engine genuinely fixes, what KV version 2 stores alongside each value, and why writing a new version changes nothing in the system the credential authenticates against.→
- Policies and least privilege: path rules, capabilities and the KV v2 splitHow a path rule and its capability list decide every request, why an explicit deny beats everything else, and why a read grant on a KV version 2 data path does not let the holder list anything.→
- Tokens, authentication methods and identityWhat a session token really is, how its time to live is bounded by three separate numbers, what revocation cascades to, and why a token with a long lifetime is a static secret wearing a costume.→
- Audit without leaking: what to record and what must never be recordedWhy OpenBao 2.6 refuses to enable an audit device through the API, how the configuration stanza replaces it, and what a real audit record contains once the secret values and tokens have been hashed out of it.→
Part XIII
Dynamic Credentials and Workload Identity
6 checks
- Dynamic credentials: a database login that did not exist a minute agoHow a secrets engine manufactures a database principal on request, binds it to a lease, proves it against a real PostgreSQL cluster, and destroys it on revocation.→
- Leases and TTLs: choosing an exposure window you can actually operateThe lease is a contract with two obligations. This lesson reads a live lease, works through renewal ceilings, and treats the shorter-TTL decision as the genuine engineering trade-off it is.→
- Authenticating machines: AppRole, Kubernetes, JWT and client certificatesFour machine authentication methods, compared by the only question that matters: what does the workload present, and what independent authority verifies it before a token is issued?→
- The secret-zero problem: how a machine gets the credential that gets its credentialsThe bootstrap regress in full, why distributing a secret to obtain secrets only relocates it, and the four mechanisms that genuinely terminate the chain rather than lengthening it.→
- Workload identity: exchanging a platform-issued token for a short-lived credentialThe federation pattern that removes stored credentials from pipelines and workloads, the three claims a relying party must pin, and the subject-format change that silently breaks trust policies.→
- SPIFFE and SPIRE: a universal identity namespace and what it costs to run oneSPIFFE IDs, trust domains and the three SVID formats, how SPIRE attests nodes and workloads, and an honest account of the operational burden and the estates that should not take it on.→
Part XIV
Platform Integration
7 checks
- Kubernetes Secrets and the cluster PKIHow a Kubernetes Secret is really stored, who can read it, what encryption at rest does and does not defend against, and which certificate authorities the control plane depends on.→
- Kubernetes workload identity and certificate incidentsProjected ServiceAccount tokens, the missing revocation API, the extended-expiry default, the CSR signers nobody approves, and the certificate rotations kubeadm will and will not perform for you.→
- Container build secrets, image layers and runtime injectionWhy deleting a file in a later layer does not remove it from an image, why build arguments are permanent, and how secret mounts and runtime injection put a credential where it belongs.→
- Terraform state, sensitive values and provider credentialsWhy the sensitive argument does not keep a value out of state, what a state file is worth to an attacker, and how ephemeral values and write-only arguments finally change the answer.→
- Ansible Vault, no_log and external secret lookupsWhat Ansible Vault protects and for how long, why encrypted variables cannot be rekeyed, the documented gaps in no_log, and why a secret lookup is a control-node operation.→
- CI/CD credentials: OIDC federation, log masking and runner compromiseHow a pipeline can hold no long-lived cloud credential at all, which claims a trust policy must pin, why log masking is best effort, and what a fork trigger can reach.→
- Databases and network devices: identity, rotation and connection poolsServer and client identity for datastores, why a connection pool survives a password change, and the certificates on firewalls, VPN concentrators and management interfaces that nobody renews.→
Part XV
KMS, HSM and Key Protection
6 checks
- Key management services: what you delegate and what it costsWhat a key management service actually takes over, why key material that never leaves a hardware boundary changes your threat model, and the availability, cost and authorisation debts you take on in exchange.→
- Envelope encryption in practice: key-wrapping keys and data keysThe two-tier pattern that makes delegated keys usable for bulk data: what the key-wrapping key and the data key each do, the exact call sequence for encrypt and for decrypt, and the fields you must store beside every ciphertext.→
- Hardware security modules and what non-exportable really meansThe two PKCS #11 attributes that make a key non-exportable, the operations that remain available once it is, the defaults that quietly undo the protection, and what a FIPS 140-3 certificate does and does not tell you.→
- Key rotation in a KMS: what it does and what it definitely does notRotating a key-encryption key creates new material for new writes and changes nothing about data already encrypted. This lesson gives the precise semantics, the NIST cryptoperiod and key-state model behind them, and the re-encryption job you must build yourself.→
- Backing up key material, and when a key must not be recoverableRecoverability is a decision you are required to make per key type, not a policy you apply everywhere. This lesson works through which keys should be backed up, which must not be, what an HSM backup really contains, and why the restore path is where the protection is usually lost.→
- Root key recovery, quorum and break-glassA root key that nobody can recover and a root key that one administrator can recover are both failures. This lesson covers split knowledge as the standards define it, quorum sizing, the circular dependencies that break glass, and why an untested recovery is not a recovery.→
Part XVI
Rotation Without Outage
6 checks
- Why instant credential replacement causes outagesReplacing a credential in one action changes the verifier immediately and the holders eventually. This lesson explains the interval between those two events, why it produces delayed outages, and the five-phase transition that removes it.→
- The dual-credential rotation pattern in detailDual acceptance is the mechanism that makes rotation survivable, but it only works when the verifier can hold two credentials, tell them apart, and report which one was used. This lesson covers all three, and what to do when it cannot.→
- Rotating a database password with no downtimeA connection pool authenticates once and then reuses the connection for hours, so a password change appears to succeed and fails much later. This lesson works through the two-role rotation that removes that trap, step by step.→
- Rotating certificates and private keys across a fleetA renewed certificate on disk changes nothing until the process reloads, and a reload can fail without saying so. This lesson covers staged deployment, verifying the served certificate rather than the file, and making the reload observable.→
- Rotating an intermediate CAAn intermediate travels in the chain rather than living in a trust store, which is why it can be replaced without touching a single client. This lesson covers the ordering, the overlap driven by leaf lifetime, and the name-collision trap.→
- Root and trust anchor migrationA trust anchor is the only part of a PKI that no protocol distributes, so replacing one means reaching every trust store that exists. This lesson covers the strict ordering, proving coverage, cross-signing, and why withdrawal has no cheap rollback.→
Part XVII
Inventory, Discovery and Monitoring
6 checks
- You cannot rotate what you do not know existsWhy every credential operation is a loop over a set, how an estate loses count of the credentials it depends on, and what an incomplete register costs during rotation, expiry and compromise response.→
- Building a credential inventory that stays trueThe fields that make a credential register actionable rather than decorative, the identifier that survives renewal, and the reconciliation loop that keeps observed reality and recorded intent from silently diverging.→
- Discovering certificates across an estateEndpoint probing, host and image scanning, CA issuance records and certificate transparency: what each discovery method can see, what it structurally cannot, and why their union is still not the whole estate.→
- Monitoring certificate expiry so it actually catches itWhy the served certificate is the only measurement that counts, how the checkend exit code turns a date into a machine answer, how to derive lead time from the renewal path, and how to detect the monitor itself failing.→
- Monitoring a secret manager: availability, denials and leasesThe five signal classes a secret manager produces, why a sealed instance is an outage with a human in the recovery path, what a denial looks like as structured data, and why issuance failures only hit new workloads.→
- Alert design for credential and certificate riskWhat separates a page from a ticket, how to derive both thresholds arithmetically from the renewal path, why the alert key must be the unit of remediation, and how a rule earns the right to keep firing.→
Part XVIII
Incidents and Recovery
7 checks
- A secret is exposed: the first hourThe ordered first-hour response to a leaked credential, why revocation or rotation always precedes cleanup, and how to size usage and exposure from audit data rather than from guesswork.→
- Private key compromise: TLS server keysWhy a compromised TLS server key demands a new key pair rather than a renewal, why revocation is weakly enforced by mainstream clients, and why replacement speed and short lifetimes are the controls that actually work.→
- CA compromise: the incident that is different in kindWhat changes when the compromised key is a certificate authority key, why every certificate it ever issued becomes suspect, and how the conceptual response runs from stopped issuance through a replacement hierarchy to validated ecosystem recovery.→
- Compromised CI, cloud and SSH credentialsHow the response differs between a CI token, a cloud access key and an SSH credential, how to compute what each could reach from its authorisation, and how to establish blast radius from audit data rather than assumption.→
- Secret manager outage and its failure modesWhat a sealed or unreachable secret manager does to applications that fetch at startup, fetch per request or hold leases, why those populations fail at different times, and how to sequence recovery once the service returns.→
- Backup and disaster recovery for PKI and secret stateWhat a complete backup of a certificate authority and a secret manager actually contains, which parts are routinely forgotten until the restore fails, and how to prove a recovery path by exercising it on an isolated host.→
- Break-glass access, and testing it before you need itHow to store, control, audit and rotate the credentials that work when everything else is down, and how to run a scheduled drill that produces a measured time to access rather than a comfortable assumption.→
Part XIX
Production Architecture
6 checks
- Trust boundaries: drawing the diagram that mattersIdentify the points where an estate stops trusting an assertion and starts verifying it, name the seven actors that appear in every secrets architecture, and turn the drawing into checks a reviewer can run.→
- Least privilege in two dimensions: retrieving a secret and using a keyThe authority to obtain a value and the authority to cause a key to be used are different grants with different blast radii. This lesson shows where the second is available, where it cannot be, and what risk it leaves behind.→
- What belongs in Git, and what never doesPolicy, certificate profiles and automation belong in version control; private keys, production passwords and unencrypted tokens do not. This lesson also takes the encrypted-secrets-in-Git approaches seriously and states what they still depend on.→
- Reference architecture: internal PKIAn offline root, an online issuing CA, automated enrolment and the services that consume it, drawn with the monitoring and rotation paths included and with the failure of each component costed honestly.→
- Reference architecture: workload secretsPlatform-attested workload identity exchanged for a leased credential that the target system itself expires. This lesson traces the chain backwards until it terminates, and prices the availability cost of putting a secret manager on the request path.→
- Reference architecture: delivery-pipeline identityA CI job proves who it is with a token its own platform mints, exchanges it for a credential that expires with the job, and leaves nothing worth stealing behind. The course closes by running the six questions against the finished architecture.→
Part Capstone
Production Capstone
1 check