Cryptography: Learn Public Key Infrastructure (PKI) from Scratch Course

Lesson 1 • Asymmetric Encryption and Key Pairs

Explains public/private key mathematics and how asymmetric encryption solves key distribution. Directly enables understanding of PKI certificate mechanics.

Lesson 2 • Cryptographic Hash Functions

Defines hashing properties—collision resistance, preimage resistance, and determinism. Hashes are essential to certificate integrity and digital signatures.

Lesson 3 • History and Purpose of Cryptography

Traces cryptography from classical ciphers to modern algorithms, establishing why it matters. Provides context for every PKI mechanism introduced later.

Lesson 4 • Digital Signatures and Non-Repudiation

Shows how private keys sign data and public keys verify it, ensuring authenticity. Non-repudiation is a core PKI guarantee students must internalize early.

Lesson 1 • PKI Trust Models and Hierarchies

Compares single-root, cross-certification, and bridge CA models for establishing inter-organizational trust. Students select appropriate models for given scenarios.

Lesson 2 • Certificate Authorities and Trust Anchors

Explains how CAs issue, sign, and revoke certificates, establishing the root of trust. Students understand why CA compromise is catastrophic.

Lesson 3 • What Is Public Key Infrastructure

Defines PKI as a framework of policies, hardware, software, and procedures. Connects cryptographic primitives from Chapter 1 to a structured trust system.

Lesson 4 • Registration Authorities and Subscribers

Covers the RA's identity-vetting function and the subscriber's obligations. Clarifies the division of labor that keeps CA operations secure.

Lesson 1 • X.509 Certificate Format Deep Dive

Walks through every X.509 v3 field—version, serial number, subject, issuer, validity, and public key. Provides the technical literacy needed for all later PKI tasks.

Lesson 2 • Certificate Encoding and File Formats

Explains DER, PEM, PKCS#7, PKCS#12, and JKS formats and their interoperability. Students convert between formats confidently in lab environments.

Lesson 3 • Certificate Extensions and Constraints

Covers critical and non-critical extensions including key usage, extended key usage, and name constraints. Extensions control what a certificate is authorized to do.

Lesson 4 • Certificate Chain Validation Process

Details path building, signature verification at each level, and policy chaining. Students trace validation failures to their root cause systematically.

Lesson 1 • Certificate Enrollment and Request Formats

Covers PKCS#10 CSR creation, required fields, and submission protocols. Proper enrollment is the entry point to every certificate's lifecycle.

Lesson 2 • Certificate Suspension and Revocation

Covers CRL and OCSP revocation mechanisms, reason codes, and timing requirements. Revocation is the primary response to key compromise or policy violation.

Lesson 3 • Certificate Expiration and Archival

Addresses expiration handling, certificate archival for long-term validation, and cleanup procedures. Ensures compliance with retention policies after certificate end-of-life.

Lesson 4 • Certificate Issuance and Signing

Explains how a CA signs a CSR, applies extensions, and returns the certificate. Students understand the signing ceremony and its security controls.

Lesson 1 • Revocation Checking in Applications

Shows how browsers, OS clients, and custom apps perform revocation checks. Students configure and test revocation enforcement in real software stacks.

Lesson 2 • Certificate Revocation Lists In Depth

Examines CRL structure, delta CRLs, and distribution point configuration. Students publish and consume CRLs correctly in enterprise environments.

Lesson 3 • OCSP Stapling and Performance

Explains how servers staple OCSP responses to TLS handshakes, reducing client latency. Stapling is the modern best practice for high-traffic environments.

Lesson 4 • OCSP Protocol and Responders

Details OCSP request/response format, responder signing, and nonce usage. OCSP provides real-time revocation status without full CRL downloads.

Lesson 1 • CA/Browser Forum Baseline Requirements

Covers the publicly trusted CA requirements for certificate content, validity periods, and key sizes. Non-compliance results in distrust by major browser vendors.

Lesson 2 • PKI Risk Management and Incident Response

Identifies PKI-specific risks—key compromise, mis-issuance, and CA breach—and response procedures. Students build incident response playbooks for PKI environments.

Lesson 3 • Validation Levels and Assurance Classes

Distinguishes Domain Validation, Organization Validation, and Extended Validation certificate classes. Assurance level determines vetting rigor and relying-party trust.

Lesson 4 • Certificate Policy and CPS Documents

Explains the RFC 3647 framework for writing CP and CPS documents and their legal weight. These documents define the rules every PKI participant must follow.

Lesson 1 • Automating Certificate Issuance with ACME

Covers the ACME protocol for automated domain validation and certificate issuance. Automation eliminates manual renewal errors and reduces operational overhead.

Lesson 2 • PKI Monitoring and Operational Health

Defines metrics, alerting, and dashboards for CA availability, certificate expiry, and CRL freshness. Proactive monitoring prevents silent PKI failures.

Lesson 3 • Designing a PKI Hierarchy

Guides students through sizing, tier selection, and naming conventions for a PKI deployment. Good design decisions here prevent costly restructuring later.

Lesson 4 • Building a CA with OpenSSL

Step-by-step root and intermediate CA creation using OpenSSL configuration files. Students gain hands-on command-line proficiency with the most widely used PKI tool.

Lesson 1 • Certificate Transparency and Audit Logs

Explains CT log structure, SCT embedding, and how monitors detect mis-issuance. CT is now mandatory for publicly trusted TLS certificates.

Lesson 2 • Short-Lived Certificates and Zero-Touch PKI

Covers the trend toward certificates with very short validity periods that eliminate revocation complexity. Students evaluate trade-offs between automation cost and revocation overhead.

Lesson 3 • Decentralized Identity and Verifiable Credentials

Introduces DIDs, verifiable credentials, and their relationship to traditional PKI trust models. Students assess where decentralized identity complements or replaces PKI.

Lesson 4 • PKI in Cloud and Containerized Environments

Addresses managed CA services, service mesh mTLS, and secrets management integration. Cloud-native PKI patterns differ significantly from traditional on-premises deployments.