Capítulo 8 de 8

PKI in practice

Inventory, automation, incident response when a CA fails, and a glossary for revision.

Unos 11 minutos de lectura

Al terminar este capítulo podrá

  • Describe what a certificate inventory must record
  • Outline an incident response for a compromised CA key
  • Recognise the operational metrics worth monitoring
  • Rehearse the vocabulary needed for the certification exam

En este capítulo

  1. 1. You cannot manage what you cannot list
  2. 2. When a CA fails: the eMudhra pattern
  3. 3. Metrics worth watching
  4. 4. Revision glossary

01You cannot manage what you cannot list

In real organisations certificates are everywhere: load balancers, container secrets, mail servers, VPN concentrators, code-signing pipelines, laptops and IoT devices. The first operational capability to build is an inventory.

RecordWhy it matters
Issuer and chainTells you the blast radius if a CA is distrusted
Subject and SANsDetects name sprawl and forgotten hostnames
Owner and applicationTurns an alert into a phone call
Location (host, store, file, HSM)Makes replacement possible without guessing
Expiry and renewal methodTurns renewal into routine instead of an incident

Discovery tools help, but the durable value is ownership: a certificate with no named owner is a future outage with no one to call.

02When a CA fails: the eMudhra pattern

In October 2026, several eMudhra intermediate CA keys were found to be far weaker than intended, and browsers blocked the affected certificates within hours. The response shows what a mature CA incident looks like in practice.

  1. 1

    Receive and verify the report

    Assess whether the claim is credible, ideally by checking a signature made with the key.

  2. 2

    Block centrally

    Browsers pushed blocklist updates that took effect without requiring a software update.

  3. 3

    Ship a fix for locked-down clients

    Browsers released point versions with the blocklist built in, for machines where live updates are disabled.

  4. 4

    Fix the trust store

    The signing root was removed for software that consumes the store but not live blocklists.

  5. 5

    Push the change down the stack

    Language runtimes, certificate bundles and operating systems shipped their own updates.

  6. 6

    Communicate and re-issue

    Affected customers reissued certificates through unaffected intermediates.

03Metrics worth watching

  • Certificates expiring in the next 30, 14 and 7 days, by owner
  • Percentage of certificates renewed automatically versus by hand
  • Chain completeness failures seen from outside your network
  • Age of the newest CRL, and availability of OCSP responders
  • Number of distinct issuers and roots in use — a proxy for how hard a migration will be

04Revision glossary

CA
Certificate authority: the party that signs certificates and is trusted to do so.
CRL
Certificate revocation list: a signed list of revoked serial numbers.
CSR
Certificate signing request: public key plus requested names, signed by the requester.
EKU
Extended Key Usage: the purposes a certificate may be used for.
HSM
Hardware security module: tamper-resistant hardware that stores and uses keys.
Leaf
The end-entity certificate presented by a server or device.
RCG
Root of trust: a self-signed root certificate a client already trusts.
SAN
Subject Alternative Name: the names a certificate is valid for.
Why can a browser accept a certificate that a Java application rejects?

They use different trust stores and different validation behaviour, for example around revocation and intermediate fetching.

What does a certificate prove about the holder?

That the holder controls the private key matching the public key bound to the name in the certificate.

What is the first thing to check when a chain fails?

Whether the server sent the intermediates; a missing intermediate is the most common cause.

Para recordar

  • Inventory plus ownership is the foundation of PKI operations
  • CA incidents require coordinated blocking, root distrust and downstream updates
  • Automation coverage and expiry lead time are the metrics that prevent outages
  • Revise the vocabulary before sitting the certification exam
AnteriorRunning your own certificate authorityCurso completadoRealizar el examen de certificación

Profundice:PKI Trust Manager admin guidePKI Trust Manager MSCA API reference