PKI governance and trust architecture
You compare trust models, root programmes and e-signature regulations with examples from around the world, and prepare a PKI governance document covering the key ceremony, HSM operations, separation of duties, audit and disaster recovery.
Level 501 · 13 lessons · 12 practice labs
Lessons
Trust models
- Trust models: hierarchy, bridge, cross-signing
- Root programmes and browser trust stores
- E-signature regulations: eIDAS and examples from other countries
- Short task: compare the pros and cons of two trust models for an organisation
Governance
- The key ceremony: creating the root CA on record and with witnesses
- HSM operations, backup and access control
- Separation of duties: CA administrator, auditor, registration officer
- PKI audits and compliance requirements
- Short task: prepare a key ceremony script and a minutes template
Continuity
- The CA disaster recovery plan
- Managing code-signing certificates
- The PKI roadmap and crypto agility
- Capstone: prepare a PKI governance document and ceremony plan for an organisation
Practice labs
- Audit the roots in a trust store: List the root certificates in the lab server's trust store and flag those not in company policy or expired.
- Work out which path a cross-signed chain uses: Examine two cross-signed chains in the lab, show which path different clients build and explain what happens when the old root is removed.
- Compare two trust models for a company: Compare the hierarchy and bridge models for Bakırdere Madencilik and its partner on cost, risk and management effort, and write a recommendation.
- Prepare the key ceremony roles and checklist: Define administrator, witness and auditor roles for a root CA ceremony and prepare a checklist to tick off during it.
- Write a key ceremony script and minutes template: Write a step-by-step ceremony script and minutes template for the lab root, stating the evidence collected at each step.
- Run a recorded key ceremony rehearsal: Carry out offline root key generation in the lab following the script, log each step's output in the minutes and report deviations.
- Build a separation of duties matrix: Prepare the permission matrix for CA administrator, auditor and registration officer and find conflicting rights held by one person.
- Review HSM operation and backup records: Review sample HSM access and backup records in the lab and report out-of-policy access and missing backup verification.
- Run a compliance gap analysis for a PKI audit: Compare Yelkovan Bankası's lab PKI documents with an audit checklist, prioritise the gaps and write a remediation plan.
- Inventory code signing certificates: Record the owner, key location and end date of the lab's code signing certificates and flag the risky one.
- Write a CA disaster recovery plan and test it on paper: Write recovery steps for losing the intermediate CA server, find gaps with a tabletop exercise and update the plan.
- Prepare a PKI governance document and roadmap: Write a governance document and roadmap for Demirsu Enerji covering roles, ceremonies, audit, disaster recovery and crypto agility.
About this course
You compare trust models, root programmes and e-signature regulations with examples from around the world, and prepare a PKI governance document covering the key ceremony, HSM operations, separation of duties, audit and disaster recovery.
What you will learn
- Trust models
- Governance
- Continuity
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.