PKI & Certificates Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A certificate is a name with an expiry

A certificate binds a public key to a name for a period of time. The private key stays on the system that must prove it holds that name. You do not send the private key to a checker, a ticket, or a chat. The certificate checker on this site can look at a certificate you are allowed to examine. The OpenSSL builder drafts a command. You still read it before you run it on a host you administer.

The name on the certificate must be a name you control. example.com is documentation. A lab can use a name that resolves only in the lab, or a local certificate that no public directory will trust. A public certificate is for a name whose DNS you can change, requested when you mean to renew it.

Expiry is a date you put on a calendar. A certificate that expires on a weekend is a certificate you renew the week before. The renewal uses the same discipline: a new key or the product's documented reuse, a config test, a reload, and the previous certificate kept until the new one answers.

A private certificate authority is a system of its own, with a root you protect more carefully than any leaf. You do not create one because a lab command was short. If you already have one, this page does not replace its runbook. It reminds you that the root key is not an everyday file.

One lab name, one key, one expiry

Pick a lab name you will not put in public DNS. Create a key and a certificate the lab trusts, or use the product's local certificate. The key file is not world-readable. The certificate file can be world-readable. Those are different files. If a command prints the key into the terminal scrollback, clear that scrollback and treat the key as exposed if anyone else could see it.

Point the lab service at the certificate and the key. Run that service's config test. Reload with a console open if a bad path would stop the service. Fetch the lab name and read the expiry and the name that came back. They match the ticket.

Set a reminder earlier than the expiry. The reminder names the host, the file path, and the person. A reminder that says renew certs is not a reminder.

The checker, if you use it, is given the certificate, not the private key. If the draft OpenSSL line includes a password, the password is prompt-for-this and is not stored in the shell history you keep.

# Lab only. Review before you paste.
# Name: a lab name you control, not a public name you do not own.
# Key file stays unreadable to the world. Do not put the key in the ticket.
# prompt-for-this is not a passphrase to keep.
# Config test, then reload, then read the expiry.

A change you can finish

Production uses a name you control and a renewal path you have used once in the lab. The first public certificate is one name, one service.

Rollback is the previous certificate and key paths, which you did not delete, and the reload command.

Write the exact name and the expiry you expect.
Create or obtain the certificate for that name only.
Store the private key with a tight mode. Keep it out of the ticket.
Pass the service config test.
Reload and read the name and expiry from a connection.
Put the renewal date on a calendar with the path and the owner.
Leave every other name for a later window.

Mistakes that outlive the command

certificates fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Requesting a public certificate for a name you do not control.
Putting the private key in the ticket, the chat, or the checker.
A world-readable key file.
Renewing by deleting the old files before the new files answer.
A reminder with no date and no path.
Building a private root because one lab command looked easy.
Skipping the config test.
Using example.com in production because the guide used it.

Decisions to write down before the window

One decision for certificates: The name is one you control. example.com stays in the lab note. The private key is a file with a tight mode and is absent from the ticket. The checker saw the certificate, not the key. The config test passed before reload. The presented name and expiry match the ticket. A renewal date, path, and owner are on a calendar. The previous files remain until the new certificate answers. A private root is out of scope unless its own runbook is the ticket. The OpenSSL draft was read. A passphrase in it is prompt-for-this. And one name moved in this window.

The hour you stop

Write the hostname or the system name, the owner, and the clock time before you change anything for certificates. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.

One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.

A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.

Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.

Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next system waits until someone else can repeat the proof from the notes. certificates is done for this window when the proof is written, not when the tool printed a file.

This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.

Certificate checks before the name is public

Confirm this before you call the change done: The name in the certificate matches the ticket. The private key is not in the ticket. The key file is not world-readable. The config test passed. A connection shows the expected expiry. The renewal reminder has a date and a path. The previous certificate files are still available. example.com was not left on a production listener. The checker was not given the private key. A second person read the name aloud. No second name was added. The cryptography guide's rule on prompt-for-this was kept. The hostname in the prompt matches the hostname in the ticket for certificates. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for certificates happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.