Crash course
PKI in 90 minutes
Ten short lessons that take you from 'what is a key?' to certificate chains, outages and post-quantum plans, in about 90 minutes, with no account and nothing to install.
Who is this course for?
This course is for people who need to understand PKI but will not play a game or read a handbook cover to cover:
- Managers, risk and compliance leads, and auditors who need to know what their teams do with certificates, what can go wrong and which questions to ask.
- Busy engineers who want the whole picture quickly, or a refresher before an incident review or an audit.
- Curious beginners, including students. Lessons 1 to 3 assume nothing at all.
Every lesson has a short “Ask your team” box and ends with plain takeaways, so a non-specialist leaves each lesson with something concrete to check.
How does it work?
There are 10 lessons of about nine minutes each, roughly 90 minutes in total. Take them in order: each one builds on the one before. Every lesson has the same shape:
- The situation: a real moment, such as a certificate warning or a weekend outage.
- What is going on: a short explanation with one diagram and the real terms.
- Try it: a small tool that runs in your browser on sample certificates (lesson 1 uses a short thought exercise instead).
- Check: three questions, each with an explanation of what happened, why, and the rule to remember.
- Takeaways: three points to keep, with links to go deeper.
There is no account, no sign-up and nothing to install, and every lesson works on a phone.
How do I use it with my team?
- Send the link. Each lesson is its own page, short enough for a commute or a coffee break.
- One lesson a week. Ask everyone to read the lesson before a team meeting, then spend ten minutes on its “Ask your team” questions. Ten weeks cover the course.
- Mix the audiences. When managers and engineers read the same lesson, the gaps tend to surface: the certificate nobody owns, the renewal nobody automated.
Teachers will find a lesson plan and a worksheet on the page for teachers. If you only have ten minutes, start with PKI for leaders. Proof of completion for teams is planned; see teams.
What comes after the course?
- The handbook goes deeper on every topic, in 26 chapters with commands, standards and real examples. Each lesson links to its chapters. Start at the handbook.
- The error pages and tools help when something breaks: paste your error or browse the error pages.
- The game teaches the same ideas by playing, one level per chapter. It is not open yet; see what is coming.
The lessons are listed below. Start with lesson 1, even if you think you know it: it is short, and everything else builds on it.
The lessons
Lesson 1 · 8 min
Secrets and the sharing problem
One shared secret key can encrypt anything strongly, but getting that key safely to everyone who needs it does not scale, and that is the problem PKI exists to solve.
Lesson 2 · 9 min
Two keys
A key pair lets strangers agree a fresh secret over an open network, and fast symmetric encryption then protects the data: that is how every HTTPS connection starts.
Lesson 3 · 9 min
Fingerprints and signatures
A hash is a short fingerprint of any data; a digital signature made with a private key proves the data is unchanged and was signed by whoever holds that key.
Lesson 4 · 9 min
Whose key is it?
Encryption and signatures only help with the right public key; a certificate is a signed statement, from an issuer you trust, binding a public key to a name.
Lesson 5 · 10 min
Names, jobs and asking for a certificate
A certificate is valid only for the names in its SAN and the jobs in its extensions; you get one by sending a CSR and keeping the private key.
Lesson 6 · 10 min
Chains and trust stores
A client trusts a certificate only if it can build a chain of signatures to a root already in its own trust store, so servers must send every intermediate.
Lesson 7 · 9 min
The handshake and its errors
In the TLS 1.3 handshake the server proves it holds its certificate's key while ECDHE agrees the session secret; each failed check becomes a different error message.
Lesson 8 · 9 min
When trust breaks
Revocation is a weak brake because most clients soft-fail, Certificate Transparency makes wrong certificates visible, and failing CAs are removed from trust stores.
Lesson 9 · 10 min
Running PKI
Many PKI outages are expired certificates nobody tracked; as lifetimes keep shrinking, an inventory, ACME automation and well-guarded CA keys are no longer optional.
Lesson 10 · 8 min
Beyond the browser, and what comes next
The same building blocks secure APIs with mutual TLS, software with code signing and devices from the factory, and post-quantum cryptography is the next change to plan for.