Secrets, PKI & Certificates · Operational reference
Toolkit
Operational artefacts for Secrets, PKI & Certificates: checklists for cadences, runbooks for incidents, hands-on labs for skills, and break/fix scenarios for troubleshooting reflexes. None of this replaces reading the corresponding lessons — these are the artefacts you keep open in a second tab during real work.
- Runbooks
- 26
- Checklists
- 15
- Labs
- 26
- Break/Fix
- 30
- Assessments
- 2
Operational checklists
Repetitive tasks performed on a schedule.
Before deployment
Quarterly
Annual
Runbooks
Step-by-step procedures. Treat the rollback as part of the procedure — never skip it.
Critical risk
- criticalsecurity relevantRunbook: Respond to a Compromised Certificate Authority Key~480 min · 14 steps · verified 2026-08-26→
- criticaldata loss riskRunbook: Restore the Secret Management Service from Backup~120 min · 14 steps · verified 2026-08-26→
- criticalcluster affectingRunbook: Perform a Root Trust Transition~480 min · 14 steps · verified 2026-08-26→
- criticaldata loss riskRunbook: Restore an Internal PKI From Backup~240 min · 14 steps · verified 2026-08-26→
- criticalcluster affectingRunbook: Emergency Response to Mass Certificate Expiry~180 min · 14 steps · verified 2026-08-26→
High risk
- highsecurity relevantRunbook: Replace a Compromised Certificate and Key~90 min · 14 steps · verified 2026-08-26→
- highservice affectingRunbook: Rotate a Database Password Without an Outage~75 min · 13 steps · verified 2026-08-26→
- highsecurity relevantRunbook: Respond to a Credential Committed to a Git Repository~90 min · 14 steps · verified 2026-08-26→
- highsecurity relevantRunbook: Respond to a Secret Printed in Pipeline Logs~70 min · 13 steps · verified 2026-08-26→
- highsecurity relevantRunbook: Respond to a Compromised API Key~75 min · 14 steps · verified 2026-08-26→
- highsecurity relevantRunbook: Respond to a Compromised SSH Key~90 min · 14 steps · verified 2026-08-26→
- highservice affectingRunbook: Recover an Unavailable Secret Manager~45 min · 13 steps · verified 2026-08-26→
- highcluster affectingRunbook: Rotate an SSH Certificate Authority~90 min · 14 steps · verified 2026-08-26→
- highservice affectingRunbook: Rotate an Intermediate Issuing CA~240 min · 14 steps · verified 2026-08-26→
Medium risk
- mediumservice affectingRunbook: Repair a Broken Certificate Chain~35 min · 13 steps · verified 2026-08-26→
- mediumservice affectingRunbook: Resolve a Certificate Hostname Mismatch~30 min · 12 steps · verified 2026-08-26→
- mediumservice affectingRunbook: Renew and Deploy a Server Certificate~45 min · 10 steps · verified 2026-08-26→
- mediumservice affectingRunbook: Rotate a Server Private Key~50 min · 13 steps · verified 2026-08-26→
- mediumsecurity relevantRunbook: Revoke a Certificate~45 min · 12 steps · verified 2026-08-26→
- mediumservice affectingRunbook: Troubleshoot an ACME Renewal Failure~45 min · 13 steps · verified 2026-08-26→
- mediumservice affectingRunbook: Rotate an Application Credential~60 min · 13 steps · verified 2026-08-26→
- mediumservice affectingRunbook: Troubleshoot Secret Manager Authentication Failure~35 min · 13 steps · verified 2026-08-26→
- mediumsecurity relevantRunbook: Troubleshoot Secret Manager Authorisation Failure~40 min · 13 steps · verified 2026-08-26→
- mediumservice affectingRunbook: Investigate a Mutual TLS Failure~60 min · 13 steps · verified 2026-08-26→
Hands-on labs
Time-boxed exercises.
C · Simulation
- Lab 1: Inspect an X.509 certificate from a file and from a live endpoint~35 min · 4 objectives→
- Lab 2: Generate keys safely and prove key to certificate correspondence~35 min · 4 objectives→
- Lab 3: Create and inspect a certificate signing request~40 min · 4 objectives→
- Lab 4: Build a disposable two-tier certificate authority~60 min · 4 objectives→
- Lab 5: Issue a server certificate and put it through the whole verification matrix~50 min · 4 objectives→
- Lab 6: Configure TLS on a real service and verify it from a real client~50 min · 4 objectives→
- Lab 7: Diagnose a broken certificate chain~50 min · 4 objectives→
- Lab 8: Diagnose a hostname mismatch~40 min · 4 objectives→
- Lab 9: Diagnose an expired certificate~40 min · 4 objectives→
- Lab 10: Inspect a TLS handshake~45 min · 4 objectives→
- Lab 11: Install a private trust anchor~50 min · 4 objectives→
- Lab 12: Configure and verify mutual TLS~60 min · 4 objectives→
- Lab 13: Automate issuance with ACME~70 min · 4 objectives→
- Lab 14: Prove renewal and reload~55 min · 4 objectives→
- Lab 15: Run an internal ACME certificate authority~70 min · 4 objectives→
- Lab 16: Configure SSH public-key authentication correctly~40 min · 5 objectives→
- Lab 17: Build an SSH certificate authority~75 min · 6 objectives→
- Lab 18: Issue and revoke SSH certificates~60 min · 6 objectives→
- Lab 23: Rotate a database password with zero downtime~70 min · 5 objectives→
- Lab 24: Monitor certificate expiry before it breaks~50 min · 5 objectives→
- Lab 25: Recover from a secret-manager outage~65 min · 5 objectives→
- Lab 26: Restore a PKI from backup~70 min · 5 objectives→
B · Nested virtualisation
Break/Fix scenarios
Troubleshooting drills. Each scenario gives symptoms and evidence, then hides the solution behind a reveal.
tls-handshake
pki-trust-store
tls-config
acme-challenge
pki-key-material
ssh-ca
secret-manager
secret-policy
secret-lease
secret-outage
dynamic-credential
workload-identity
secret-leak
- intermediateThe production database password is readable in remote state~40 min · 6 symptoms→
- intermediateA registry token is sitting in plain text in 41 days of pipeline logs~40 min · 6 symptoms→
- advancedA cloud access key is in the history, and rewriting it out made things worse~45 min · 6 symptoms→
pki-ca
cert-monitoring
key-compromise
ca-compromise
Assessments
Production-readiness examinations. Each combines auto-scored questions with scenario-based rubrics you can use to grade yourself.
- Secrets, PKI & Certificate Management for Infrastructure Engineers — Final Practical Assessment~180 min · 12 graded questions · pass ≥ 80% · verified 2026-08-26→
- Secrets, PKI & Certificate Management for Infrastructure Engineers — Final Theory Assessment~90 min · 40 graded questions · 18 in practice bank · pass ≥ 80% · verified 2026-08-26→