Practical PKI: A hands-on X.509 workshop

TLS and X.509 certificates are an integral part of Internet security, yet their inner workings can feel like a black box. In this tutorial we will explore a variety of certificate use cases and practice certificate management activities. Attendees will gain an understanding of Public Key Infrastructure (PKI) fundamentals, X.509 anatomy, and practical skills centred on FreeIPA (an open source identity management system featuring a certificate authority).

Besides the pervasive TLS (SSL) WebPKI use case, X.509 certificates are widely used in enterprise environments for Smart Card authentication, Kerberos PKINIT, and 802.1X EAP system authentication. This makes X.509 and certificate management essential knowledge for systems and network administrators and DevOps engineers.

Using FreeIPA (Red Hat Identity Management) as our hands-on platform, this tutorial will cover a variety of topics and scenarios including:

X.509 and PKI fundamentals (short presentation)
Using OpenSSL to generate keys and create certificate signing requests (CSRs)
ACME (Let's Encrypt) certificate management
FreeIPA's PKI capabilities: requesting certificates, configuring certificate profiles and sub-CAs, and enabling ACME issuance
External signing and renewal of the FreeIPA CA
Smart Card authentication on Linux hosts

The session will conclude with a brief overview of current directions in PKI and X.509 including ACME, Certificate Transparency, the evolving revocation landscape and post-quantum cryptography.

This is an intermediate-level workshop. The intended audience is systems and network administrators, operations engineers, security practitioners, and anyone interested in web or network protocol security.

Participants will be provided with access to preconfigured cloud environments on which they will undertake the tutorial activities. They will need a machine with Internet access and an SSH client, and should be comfortable in a Unix command line environment.

Transcript

1. Practical PKI A hands-on X.509 workshop Fraser Tweedale Everything Open 2026
2. This workshop ▸ PKI overview ▸ FreeIPA overview ▸ The workshop environment ▸ Do the workshop! ▸ Ask questions throughout
3. For the impatient… ▸ Workshop curriculum: https://eo2026.frase.id.au/ ▸ You (should) have a card with environment access info ▸ You need: ･ Internet access + browser ･ An SSH client ･ (optional) an RDP client ▸ It's OK if you get stuck! Ask for help! (after the presentation) ▸ I will walk through the workshop modules
4. Public key cryptography CC BY-SA 4.0 https://commons.wikimedia.org/wiki/File:Public_key_making.svg
5. Public key cryptography CC BY-SA 4.0 https://commons.wikimedia.org/wiki/File:Private_key_signing.svg
6. Public key cryptography CC BY-SA 4.0 https://commons.wikimedia.org/wiki/File:Public_key_shared_secret.svg
7. Public key cryptography CC BY-SA 4.0 https://commons.wikimedia.org/wiki/File:Public_key_encryption.svg
8. Public Key Infrastructure (PKI) ▸ Solve trust, privacy and authentications problems for the internet ▸ Uses public key cryptography (no shared secrets) ▸ Certificate Authority - verifies identities and signs certificates ▸ End Entity (EE) - present certificate for signing, encryption, key agreement ▸ Relying party (RP) - verifies peer certificate
9. Chain of trust CC BY-SA 4.0 https://commons.wikimedia.org/wiki/File:Chain_of_trust.svg
10. Certificate life cycle ▸ EE proves identity or domain control to CA ▸ CA issues certificate (with a fixed validity period, possibly short) ▸ EE must renew certificate before expiry ･ Update server config, certificate stores, etc
11. X.509 anatomy ▸ Issuer DN ("DN" = Distinguished Name) ▸ Serial number (big random number) ▸ Subject DN ▸ Subject Public Key Info (SPKI) ▸ Subject Alternative Name (SAN) ･ DNS name, email address, IP address, URI, … ▸ Basic Constraints - is the subject a CA? ▸ CRL Info + Authority Information Access (AIA) - where to find revocation info ▸ Signed Certificate Timestamps (SCT) - Certificate Transparency proof
12. Algorithmic agility ▸ X.509 easily adapt to new cryptography ▸ Just define public key data and signature representations ▸ Chain of trust can use different algorithms at different levels ▸ Current efforts to standardise Post-Quantum algorithms: ML-DSA, ML-KEM and hybrid KEM.
13. Certificate use cases ▸ TLS authentication (everyone knows this one) ▸ Smart cards / user authentication ▸ VPN / IPSec / 802.1x authentication ▸ Email signing and encryption (S/MIME ; cf OpenPGP) ▸ Passports (yes, really) ▸ … the list goes on
14. PKI for the Internet ▸ Operating systems and browsers have a bundle of trusted CAs ･ CA/Browser Forum defines rules for CAs to be "publicly trusted" ･ Baseline Requirements defines the X.509 certificate profile ▸ A few BIG CAs and a long tail of small and esoteric ones ▸ TLS (HTTPS) server certificates chain up to a trusted CA ▸ Other use cases: code signing, email security ▸ Challenges: key security, revocation, threat intel
15. TLS handshake ▸ Server sends a message with its certificate ▸ Server also signs its ephemeral key ▸ Client certificate authentication is also possible, server verifies ･ a.k.a. mutual TLS / mTLS ･ client cert is often signed by private CA (e.g. Bank or Gov authn)
16. PKI for the Internet
17. Revocation ▸ Your CA (at your request or own initiative) can revoke a certificate ▸ How do RPs (e.g. browsers) find out? ▸ Certificate Revocation List (CRL): big & slow, offline ▸ Online Certificate Status Protocol (OCSP): load & reliability, privacy issues ･ OCSP Stapling mitigates these concerns ▸ CRLite: small, offline, public CAs only ▸ Alternative: don't revoke; use short lifetimes and regular validation
18. Certificate Transparency ▸ Publicly-trusted CAs are required to log all issued certs to a public log ▸ Certificates contain evidence of the logging (SCTs) ▸ Purpose: detect CA compromise or misbehaviour ▸ Extra benefit: domain owners can detect unexpected issuance ･ CT log monitors: e.g. https://crt.sh/ and others
19. Interactions with DNS ▸ CAA - which CAs do you authorise? (RFC 8659) ▸ TXT - used for domain validation, including ACME "dns" challenge ▸ TLSA - directly publish your certs / fingerprints ; requires DNSSEC ･ Mail servers are adopting it, and OpenSSL (has some support) ･ Hardly supported anywhere else, but quite interesting! RFC 6698
20. ACME ▸ = Automated Certificate Management Environment (RFC 8555) ▸ Automate domain validation and certificate request / renewal ▸ Free public CA: Let's Encrypt (and others) ▸ Enables short lifetimes (reduce impact of compromise) ▸ Validation challenges: ･ Http: drop a file in a .well-known/ location ･ Dns: publish a TXT record ･ Alpn: too complicated to explain :) ▸ Clients: certbot, mod_md (Apache), caddy, …
21. ACME
22. PKI in the enterprise ▸ Large organisations often run an internal PKI ▸ Active Directory Certificate Services (AD-CS) is common ▸ FreeIPA / RHEL Identity Management is another option ▸ Applications: TLS, VPN, 802.1x, user auth ▸ Challenges: key security, automation, revocation, cost
23. Smart cards ▸ Cryptographic token with (optional) PIN ▸ Private key + X.509 certificate ▸ Sign a challenge to prove identity ▸ Phishing-resistant ▸ Challenges: issuance, renewal and revocation ▸ USB, NFC, "SIM-esque", …
24. FreeIPA overview ▸ Identity and access management for Linux environments ▸ Includes a Certificate Authority ▸ Supported authentication methods: Password, OTP, external IdP, Passkeys, certificate / smart card
25. FreeIPA architecture
26. Workshop time! ▸ Workshop curriculum: https://eo2026.frase.id.au/ ▸ You (should) have a card with environment access info ▸ You need: ･ Internet access + browser ･ An SSH client ･ (optional) an RDP client ▸ It's OK if you get stuck! Ask for help! (after the presentation) ▸ I will walk through the workshop modules ▸ Feedback: https://eo2026.frase.id.au/feedback