🔒

SSL/TLS Certs Learning Roadmap

Certificate chains, trust, expiry, and TLS handshake debugging.

Estimated time:2–3 weeks

1🌱

Phase 1 — Fundamentals

Public/private key pairs

Certificate chain of trust (root, intermediate, leaf)

X.509 certificate fields

SANs (Subject Alternative Names)

2🔄

Let's Encrypt & ACME protocol

cert-manager for Kubernetes

CSR generation with openssl

Wildcard vs SAN certs

3🔍

Trust stores (system/browser/language-specific)

openssl s_client for handshake debugging

Common errors (expired, hostname mismatch, self-signed)

OCSP & certificate revocation

4🔐

important

Renewal automation & expiry monitoring

HSTS & TLS version/cipher hardening

Certificate pinning tradeoffs

Begin with interview questions to assess your current level.