Certificate lifecycle management: inventory, renewal and revocation
You build a certificate inventory from the network and certificate transparency logs, automate renewal with internal ACME, monitor expiry, and rehearse revocation and migration for events like key compromise and CA distrust.
Level 401 · 14 lessons · 12 practice labs
Lessons
Inventory
- Certificate discovery: network scans and certificate transparency logs
- The certificate inventory: owner, location, expiry, issuer
- Finding unrecorded and self-signed certificates
- Short task: inventory every certificate on the lab network
Automation
- Automatic renewal with ACME on the internal network
- Short-lived certificates and the need for automation
- Expiry monitoring and alerts
- Reloading services safely after renewal
- Short task: automate a service’s certificate renewal and put it under monitoring
Incidents
- Revocation and reissue after key compromise
- Migrating when a CA is distrusted
- Certificate transparency monitoring: unexpected certificates in your name
- Limiting authorised CAs with CAA records
- Capstone: set up a certificate lifecycle process for a fictional organisation and run a revocation drill
Practice labs
- Find certificates in the lab network by scanning: Scan the lab network's TLS services, collect the certificates they present and add them to the inventory with issuer and end date.
- Find unregistered and self-signed certificates: Compare scan results with the inventory, find unregistered and self-signed certificates and identify their owners.
- Inventory every certificate in the lab network with owner and location: Build a complete inventory of Ilgıntepe Tekstil's lab network, including non-web ports and certificates on disk, and report the gaps.
- Set up and test an expiry alert: Write a check that alerts 30 and 7 days before expiry for the inventoried certificates and trigger it with a fake near date.
- Set up automatic renewal with ACME on the internal network: Have a lab service's certificate renewed automatically from the internal ACME server and show the logs of two renewal cycles.
- Reload the service safely after renewal: Find a lab service that doesn't pick up its renewed certificate, add a post-renewal config test and reload step, and prove it runs without interruption.
- Revoke and reissue a certificate whose key leaked: Revoke the lab certificate whose key was reported leaked, reissue it with a new key and verify the old one is rejected.
- Find certificates sharing one key and separate them: Detect certificates in the inventory that use the same public key, give each service its own key and verify the change.
- Manage a move away from a CA declared untrusted: When a lab CA is declared untrusted, find all certificates it issued, move them to a new CA and report the migration timeline.
- Find an unexpected certificate in a transparency log: Find a certificate issued for Pusulaya Sigorta in the lab transparency log sample that isn't in the inventory, and write an incident note.
- Limit authorised CAs with CAA records: Add CAA records to the lab DNS zone and verify with the lab ACME server that a request from an unauthorised CA is refused.
- Set up the certificate lifecycle process and run a revocation drill: Document inventory, renewal and revocation steps for a fictional company, run a revocation drill and report the measured times.
About this course
You build a certificate inventory from the network and certificate transparency logs, automate renewal with internal ACME, monitor expiry, and rehearse revocation and migration for events like key compromise and CA distrust.
What you will learn
- Inventory
- Automation
- Incidents
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.