Unit 02 of 03
Public Key Infrastructure
What a public key's ownership rests on, and where that foundation breaks: the claim each certificate field proves and the path each field closes when checked, the number of items one root carries in the chain-of-trust graph and the renewal cost of what falls when the root breaks, the learning window of the CRL versus OCSP and the path a failed query opens, which step of the handshake proves which claim, the renewal window and the connections an expired item drops, and who can read the content in end-to-end encryption.
Published Updated
Lessons
- 01 Certificates Certificate fields are measured in terms of the claim they prove: which claim each of the nine fields binds, the eight items that must hold at once for a single leaf item to be usable, and how five checks close eight of thirteen usage attempts while stopping none of the five legitimate ones. 15 min read
- 02 Certificate Authorities and the Chain of Trust The load a single root carries is measured in numbers: 4,397 leaf items and 4,400 trust store copies tied to one root under four intermediate authorities, an intermediate authority breaking drops between 10 and 4,101 items while a root breaking drops 8,802 items and takes 95 workdays of manual touch; a backup root zeroes out the outage but does not change the touch count. 14 min read
- 03 Certificate Revocation The window between the revocation decision and the verifier learning it is measured: 29.5 hours on average and 271,877 accepted connections with daily list publication, 1.5 hours and 13,925 connections with the Online Certificate Status Protocol (OCSP), 0.5 hours and 4,621 connections with server-carried response; narrowing the list's window to two hours raises the daily download from 152 MB to 1,828 MB, and when the query goes unanswered, soft-fail opens 2 paths while hard-fail drops 6,161 legitimate connections. 13 min read
- 04 TLS Handshake The handshake is taken apart along its identity steps: each of six claims ties to a single step, when any of the four identity steps is turned off exactly one more of five fictional presentations gets accepted, and with no identity step at all all five of the five pass; full verification requires 11 items to hold at once, mutual verification requires 15, and at fleet scale it adds 17,552 items. 14 min read
- 05 Certificate Lifecycle Management Measured in terms of the renewal window: manually renewing 4,397 items takes 99 workdays a year, 111 items go unnoticed, and 1,458 connections drop; automation zeroes out all three numbers while adding 5 system items and turning 111 scattered breakage points into a single point that carries 4,397 items at once; shortening lifetime to one day makes the revocation notice unnecessary but raises yearly transactions from 4,397 to 1,604,905 and zeroes out the spare-attempt margin. 13 min read
- 06 End-to-End Encryption Applications What counts is who can read the content: in transport encryption, 10 of 10 layers see the content in the clear; in end-to-end encryption, 2 do. Trusted items required drop from 36 to 4, and records seen in the clear go from 30,930 thousand to 5,460 thousand a day. In exchange, 6 capabilities are lost — 4 have a 16-item edge-side counterpart, 2 do not; keeping the key only at the edge makes 172,200 records a year unrecoverable, and an escrow key that can read the content raises the layer count from 2 to 3. 14 min read