Building and running an internal certificate authority
You design and build a two-tier hierarchy with an offline root and an intermediate CA; you set extensions and name constraints, publish revocation, issue client certificates for mutual TLS, distribute the root certificate and audit the CA.
Level 301 · 17 lessons · 15 practice labs
Lessons
Design
- Why an internal CA: internal services, devices, client certificates
- CA hierarchy: an offline root and an intermediate CA
- The certificate policy and practice statement
- Short task: design a two-tier CA for a fictional organisation
Building
- Creating a root CA with OpenSSL
- The intermediate CA and constraints: path length and name constraints
- Automatic internal certificates with step-ca
- Certificate extensions: key usage and extended key usage
- Short task: build a root and intermediate CA and issue a server certificate
Operating
- Revocation: publishing a CRL and an OCSP responder
- Client certificates and mutual TLS
- Distributing the root certificate to clients safely
- Protecting the CA key: the hardware security module idea
- Auditing the CA: recording and reviewing issued certificates
- Short task: set up mutual TLS between two services and revoke a certificate
The Windows environment
- An overview of certificate services in a Windows environment
- Capstone: build and run an internal PKI and prepare its audit record
Practice labs
- List the needs for an internal CA: Inventory Akçakavak Lojistik's internal service, device and client certificate needs and decide which will come from the internal CA.
- Design a two-tier CA hierarchy: Draw a design with an offline root and an online intermediate CA, setting validity periods and name constraints with reasons.
- Find the gaps in a draft certificate policy: Review the draft certificate policy and practice statement in the lab and complete the missing revocation, key protection and audit clauses.
- Create a root CA with OpenSSL: Create the root CA key and certificate for the lab and verify the basic constraints and key usage extensions.
- Set up an intermediate CA with path length and name constraints: Set up a root-signed intermediate CA and prove it can only issue for the company domain while a request for an outside name is rejected.
- Audit the extensions of issued certificates: Audit key usage and extended key usage in ten certificates issued by the lab CA, revoke the misissued one and issue it again.
- Revoke a certificate and publish a CRL: Revoke a server certificate on the lab CA, publish a new CRL and verify the client now rejects the certificate.
- Set up and query an OCSP responder: Run an OCSP responder for the lab CA, query the status of one valid and one revoked certificate and record the results.
- Resolve an outage caused by a stale CRL: Determine the lab services are refusing connections because the CRL expired, fix CRL publishing and add a monitoring rule.
- Distribute the root certificate to clients safely: Add the root certificate to lab clients after checking its fingerprint and show the internal site opens without warnings.
- Set up mutual TLS between two services: Issue client and server certificates for two lab services, require mutual TLS and verify a client without a certificate is refused.
- Set up automatic internal certificate issuance and test revocation: Set up an automatic certificate issuance service in the lab, give two services short-lived certificates, revoke one and show its connection drops.
- Review the log of issued certificates: Pull the certificates issued in the last month from the lab CA's database and flag those with an unclear owner or request.
- Audit how the CA key is protected: Audit the file permissions, passphrase protection and backup of the lab CA key, fix the findings and write a hardware module recommendation.
- Audit template permissions in Windows certificate services: Find overly broad enrolment permissions and requester-supplied name settings in the lab domain's certificate templates, close them and prepare the audit record.
About this course
You design and build a two-tier hierarchy with an offline root and an intermediate CA; you set extensions and name constraints, publish revocation, issue client certificates for mutual TLS, distribute the root certificate and audit the CA.
What you will learn
- Design
- Building
- Operating
- The Windows environment
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.