https://pkizerotohero.com/ New and updated PKI Handbook chapters and how-to guides, and what is changing in PKI. Published by PKI Zero to Hero, by Duyutech BV. en Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/symmetric-encryption/ https://pkizerotohero.com/handbook/symmetric-encryption/ Symmetric encryption scrambles data with one secret key, and only someone who holds that same key can turn the scrambled data back into readable text. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/key-distribution/ https://pkizerotohero.com/handbook/key-distribution/ A shared secret key must reach each partner without anyone else seeing it, and every pair needs its own key, so sharing secret keys does not scale. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/key-pairs/ https://pkizerotohero.com/handbook/key-pairs/ A key pair is two keys: a public key anyone may have and a private key only you hold, so strangers can encrypt to you without sharing a secret first. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/key-exchange/ https://pkizerotohero.com/handbook/key-exchange/ Two parties can agree a shared secret over an open network without ever sending it, then derive fast symmetric keys from it to protect the actual data. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/hashes/ https://pkizerotohero.com/handbook/hashes/ A cryptographic hash turns any data into a short, fixed-size fingerprint; any change gives a completely different fingerprint, and you cannot run it backwards to get the data. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/digital-signatures/ https://pkizerotohero.com/handbook/digital-signatures/ A digital signature is a value only the private-key holder can compute for a message, and anyone with the public key can check that it matches that exact, unchanged message. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/binding-identity/ https://pkizerotohero.com/handbook/binding-identity/ Encryption and signatures only help if you use the right person's public key, so something you already trust must vouch that a key belongs to a name. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/x509-certificates/ https://pkizerotohero.com/handbook/x509-certificates/ An X.509 certificate is a public, signed record that ties one public key to names for a fixed period, and you can read every field with openssl. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/names-and-key-usage/ https://pkizerotohero.com/handbook/names-and-key-usage/ A certificate is valid only for the names in its Subject Alternative Name list, and only for the jobs that its key usage, extended key usage and CA flag allow. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/csr/ https://pkizerotohero.com/handbook/csr/ You generate a key pair, keep the private key, and send the CA a certificate signing request (CSR) carrying only your public key and the names you want. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/domain-validation/ https://pkizerotohero.com/handbook/domain-validation/ Before issuing, a CA checks that you control each name, using a file, a DNS record or a TLS response, and reads CAA records; OV and EV check the organisation. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/trust-stores/ https://pkizerotohero.com/handbook/trust-stores/ Every client trusts only the root certificates in its own trust store, so a certificate is accepted only if its chain ends at one of them; being self-signed earns nothing. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/certificate-chains/ https://pkizerotohero.com/handbook/certificate-chains/ Servers must send their leaf and intermediate certificates; clients link them by name and key identifier up to a trusted root and check every signature, date and constraint. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/cross-signing/ https://pkizerotohero.com/handbook/cross-signing/ Cross-signing gives one CA key two certificates from different issuers, so a chain can reach either an old or a new root; clients must pick a path that is valid. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/tls-handshake/ https://pkizerotohero.com/handbook/tls-handshake/ In one round trip, client and server agree fresh keys with ECDHE, the server proves it holds the certificate's key by signing the handshake, and both confirm nothing was altered. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/revocation/ https://pkizerotohero.com/handbook/revocation/ Revocation lets a CA cancel a certificate before it expires, but many clients check late, softly or not at all, so short lifetimes now do much of the work. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/certificate-transparency/ https://pkizerotohero.com/handbook/certificate-transparency/ Certificate Transparency records every publicly trusted TLS certificate in public, append-only logs, so anyone can spot a certificate for their name that they never asked for. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/famous-failures/ https://pkizerotohero.com/handbook/famous-failures/ Real PKI failures, from a hacked CA to expired certificates, follow one pattern: a weak point breaks trust, someone notices, and the rules or practices change. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/certificate-lifecycle/ https://pkizerotohero.com/handbook/certificate-lifecycle/ Every certificate expires and lifetimes keep shrinking, so you need an inventory, an owner for each certificate, monitoring of what servers really send, and automated renewal. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/acme/ https://pkizerotohero.com/handbook/acme/ ACME lets software prove control of a name, then fetch, renew and install certificates automatically: the only practical way to live with very short certificate lifetimes. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/hsm-and-key-ceremonies/ https://pkizerotohero.com/handbook/hsm-and-key-ceremonies/ A CA is only as trustworthy as its private keys, so they live in certified hardware, are created in witnessed ceremonies and are used only under multi-person control. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/private-ca/ https://pkizerotohero.com/handbook/private-ca/ A private CA lets you issue certificates for internal systems under your own rules, built safely as an offline root plus an online issuing CA with clear policies and templates. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/mutual-tls/ https://pkizerotohero.com/handbook/mutual-tls/ In mutual TLS the client also proves who it is, with a certificate and a signature from its private key, so both ends are authenticated before any data flows. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/code-signing/ https://pkizerotohero.com/handbook/code-signing/ A code or document signature proves who signed a file and that nobody changed it since; a trusted timestamp keeps that proof valid after the signing certificate expires. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/device-identity/ https://pkizerotohero.com/handbook/device-identity/ A device certificate, installed at the factory with its private key locked in secure hardware, lets a machine prove what it is and who made it, for its whole life. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/post-quantum/ https://pkizerotohero.com/handbook/post-quantum/ A large quantum computer would break RSA and elliptic-curve cryptography, so key exchange is already moving to ML-KEM, and signatures and certificates come next. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/glossary/ https://pkizerotohero.com/handbook/glossary/ Every PKI and TLS term used on this site, from ACME to X.509, each with a one-line answer, a fuller explanation and the chapter that teaches it. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/cheat-sheet/ https://pkizerotohero.com/handbook/cheat-sheet/ Tested OpenSSL, curl, keytool, Windows and Kubernetes commands for everyday certificate work, grouped by the task you are trying to do. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/file-formats/ https://pkizerotohero.com/handbook/file-formats/ The formats are wrappings of the same data: DER is binary, PEM is DER in Base64, PKCS #12 bundles a key with its certificates, and PKCS #7 carries certificates only. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/timeline/ https://pkizerotohero.com/handbook/timeline/ From the first public-key papers in the 1970s to ever-shorter certificate lifetimes and post-quantum key exchange: the milestones and incidents that shaped how certificates work today. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/handbook/standards/ https://pkizerotohero.com/handbook/standards/ The RFCs, CA/Browser Forum documents, root program policies, NIST standards and EU rules that this handbook relies on, each with what it covers and where to read it. Handbook Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/inspect-certificate-openssl/ https://pkizerotohero.com/guides/inspect-certificate-openssl/ You will have read a certificate file or a server's certificate with OpenSSL and found its names, dates, issuer, key and fingerprint. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/check-remote-certificate-chain/ https://pkizerotohero.com/guides/check-remote-certificate-chain/ You will have listed every certificate a server sends, checked their order and links, and verified the chain with a strict client instead of a browser. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/check-certificate-expiry/ https://pkizerotohero.com/guides/check-certificate-expiry/ You will have read expiry dates in files, live servers and certificate stores, and set up a check that warns before any certificate in a chain runs out. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/check-key-matches-certificate/ https://pkizerotohero.com/guides/check-key-matches-certificate/ You will have proved, without exposing the key, that a private key, its CSR and a certificate share one public key, or found the file that does not belong. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/create-csr-openssl/ https://pkizerotohero.com/guides/create-csr-openssl/ You will have a new private key that never leaves your server, and a verified certificate signing request that lists every name your certificate needs. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/create-csr-windows/ https://pkizerotohero.com/guides/create-csr-windows/ You will have a CSR with all your names, whose private key stays inside the Windows key store, and know how to install the certificate when it returns. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/create-csr-java-keytool/ https://pkizerotohero.com/guides/create-csr-java-keytool/ You will have a key pair in a PKCS #12 keystore, a CSR whose SAN list really reaches the CA, and the signed certificate chain installed under the same alias. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/convert-pfx-pem/ https://pkizerotohero.com/guides/convert-pfx-pem/ You will have split a PFX into PEM files for the certificate, the chain and the key, or packed PEM files into a PFX that Windows and Java can import. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/convert-der-pem/ https://pkizerotohero.com/guides/convert-der-pem/ You will have identified whether a file is DER or PEM and converted certificates, keys, CSRs, CRLs and bundles between the two, with proof that nothing changed. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/convert-jks-pkcs12/ https://pkizerotohero.com/guides/convert-jks-pkcs12/ You will have moved every key and trusted certificate from a JKS keystore into a standard PKCS #12 file that Java, OpenSSL and Windows can read, and updated your settings. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/build-fullchain/ https://pkizerotohero.com/guides/build-fullchain/ You will have one PEM file with your certificate followed by its intermediates in the right order, verified offline and proven to work with a strict client. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/corporate-proxy-certificates/ https://pkizerotohero.com/guides/corporate-proxy-certificates/ You will have confirmed that your traffic is inspected, obtained your company's inspection root through a trusted channel, and made each tool trust it with verification still on. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/add-root-ca-windows/ https://pkizerotohero.com/guides/add-root-ca-windows/ Your Windows computer, or a whole fleet, trusts your organisation's private root CA, and you know which apps still need their own setting. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/add-root-ca-macos/ https://pkizerotohero.com/guides/add-root-ca-macos/ Your Mac, or every managed Mac, trusts your organisation's private root CA in the System keychain, and you know which apps need their own setting. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/add-root-ca-linux/ https://pkizerotohero.com/guides/add-root-ca-linux/ Your Linux server, desktop or container image trusts your organisation's private root CA system-wide, and you know which programs keep their own list. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/add-root-ca-java/ https://pkizerotohero.com/guides/add-root-ca-java/ Your Java program trusts your private root CA, either through the JDK's cacerts or through its own trust store, and you have proved it with a real connection. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/trust-ca-python-node/ https://pkizerotohero.com/guides/trust-ca-python-node/ Python, pip, requests, Node.js and npm trust your private root CA, through the operating system's store or a bundle file, with verification still fully on. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/install-certificate-nginx/ https://pkizerotohero.com/guides/install-certificate-nginx/ nginx serves your certificate and its full chain on port 443, with a key that matches, and you have proved it from the outside with OpenSSL and curl. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/install-certificate-apache/ https://pkizerotohero.com/guides/install-certificate-apache/ Apache httpd serves your certificate with its full chain from one SSLCertificateFile, with a matching key, and you have proved it from outside. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/install-certificate-iis/ https://pkizerotohero.com/guides/install-certificate-iis/ IIS serves your certificate with its private key and intermediate on an HTTPS binding with SNI, and renewed certificates get rebound instead of silently expiring. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/install-certificate-tomcat/ https://pkizerotohero.com/guides/install-certificate-tomcat/ Tomcat, or a Spring Boot or other Java server, serves your certificate with its full chain from PEM files or a PKCS #12 keystore, verified from outside. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/certbot-lets-encrypt/ https://pkizerotohero.com/guides/certbot-lets-encrypt/ certbot gets a Let's Encrypt certificate for your Linux server, installs it, renews it automatically on the CA's schedule, and reloads your web server each time. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/kubernetes-cert-manager/ https://pkizerotohero.com/guides/kubernetes-cert-manager/ cert-manager issues Let's Encrypt certificates for your Kubernetes Ingresses or Certificate resources, stores them in Secrets and renews them before they expire. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/win-acme-windows/ https://pkizerotohero.com/guides/win-acme-windows/ win-acme gets Let's Encrypt certificates for your IIS sites, binds them, and renews them every day from a scheduled task that follows the CA's renewal advice. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/wildcard-dns-01/ https://pkizerotohero.com/guides/wildcard-dns-01/ You will have a publicly trusted certificate for *.example.com and example.com, issued through the ACME DNS-01 challenge with a narrowly scoped DNS key, and renewing by itself. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/caa-records/ https://pkizerotohero.com/guides/caa-records/ You will have DNS CAA records that let only the CAs you really use issue certificates for your names, with separate wildcard rules and an address for violation reports. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/monitor-certificate-transparency/ https://pkizerotohero.com/guides/monitor-certificate-transparency/ You will have a scheduled check that lists every new publicly trusted certificate for your domains and flags any certificate issued by a CA you did not allow. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/tls-configuration/ https://pkizerotohero.com/guides/tls-configuration/ You will have a web server that offers only TLS 1.2 and 1.3 with forward-secret ciphers, staples OCSP only where it still applies, sends HSTS safely, and passes testing. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/mutual-tls-setup/ https://pkizerotohero.com/guides/mutual-tls-setup/ You will have an nginx endpoint that accepts only clients holding a certificate from your own client CA, lets in only the clients you name, and is tested with curl. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/private-ca-step-ca/ https://pkizerotohero.com/guides/private-ca-step-ca/ You will have a lab CA running smallstep's step-ca that issues and renews 24-hour certificates, speaks ACME, and refuses names outside your lab domain. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/openssl-test-ca/ https://pkizerotohero.com/guides/openssl-test-ca/ You will have a two-tier test CA built with openssl ca: a root, a name-constrained issuing CA, server and client certificates, a revocation and working CRLs. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/code-signing-signtool-cosign/ https://pkizerotohero.com/guides/code-signing-signtool-cosign/ You will sign and timestamp a Windows program with SignTool, sign a release file with Sigstore cosign, and verify both, including who signed and when. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/ssh-certificates/ https://pkizerotohero.com/guides/ssh-certificates/ You will have OpenSSH host and user certificates signed by your own CAs, so clients trust servers without first-use prompts and servers trust short-lived user certificates. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/post-quantum-tls-test/ https://pkizerotohero.com/guides/post-quantum-tls-test/ You will know whether your servers and network negotiate the X25519MLKEM768 hybrid key exchange, and how to read, force and troubleshoot it with OpenSSL 3.5. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/guides/prepare-47-day-certificates/ https://pkizerotohero.com/guides/prepare-47-day-certificates/ You will have a dated plan that moves every public TLS certificate to automated renewal, with an inventory, owners, ARI, independent monitoring and a budget, before lifetimes shrink. How-to guides Tue, 20 Oct 2026 08:00:00 GMT https://pkizerotohero.com/changes/ https://pkizerotohero.com/changes/ Dated, plain summary of what is changing in certificates and PKI: 47-day lifetimes, OCSP, clientAuth, Let's Encrypt, post-quantum and EU rules. Changes Mon, 19 Oct 2026 08:00:00 GMT