--- title: "#pki articles | Hashnode" description: "Explore 26 articles tagged #pki on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/pki" --- Tag # #pki 26 posts · 2 followers [Kazem Mortazavi](https://hashnode.com/@kazem-mortazavi) · [Nov 3](https://hashnode.com/posts/harvest-now-decrypt-later-why-post-quantum-migration-starts-today/6ae9d107d0d374bdbe15fcf6) ### [Harvest Now, Decrypt Later: Why Post-Quantum Migration Starts Today](https://securityland.hashnode.dev/harvest-now-decrypt-later-why-post-quantum-migration-starts-today?utm_source=hashnode&utm_medium=feed) Imagine that the encrypted traffic your organization sends today is being recorded and archived somewhere right now. Nobody can read it today. In a few years, someone might. That is the logic of "harv 2 min read · [securityland.hashnode.dev](https://securityland.hashnode.dev/harvest-now-decrypt-later-why-post-quantum-migration-starts-today?utm_source=hashnode&utm_medium=feed) [Kazem Mortazavi](https://hashnode.com/@kazem-mortazavi) · [Oct 28](https://hashnode.com/posts/a-ca-key-with-256-possible-values-lessons-from-the-emudhra-incident/6ae16fcf47fb6fa5dd8e2efd) ### [A CA Key With 256 Possible Values: Lessons From the eMudhra Incident](https://securityland.hashnode.dev/a-ca-key-with-256-possible-values-lessons-from-the-emudhra-incident?utm_source=hashnode&utm_medium=feed) The padlock in the address bar rests on a chain: a site certificate is signed by an intermediate certificate authority, which is signed by a root that the operating system trusts. This month we learne 2 min read · [securityland.hashnode.dev](https://securityland.hashnode.dev/a-ca-key-with-256-possible-values-lessons-from-the-emudhra-incident?utm_source=hashnode&utm_medium=feed) [Kevin Hwang](https://hashnode.com/@kevinhwang) · [Oct 23](https://hashnode.com/posts/remediate-emudhra-compromise/6adb7de8998dc4e227bcc277) ### [Remediating the eMudhra Certificate Authority Compromise](https://kevinhwang.dev/remediate-emudhra-compromise?utm_source=hashnode&utm_medium=feed) The number 4️⃣ strikes again! What users can do about it. 5 min read · [kevinhwang.dev](https://kevinhwang.dev/remediate-emudhra-compromise?utm_source=hashnode&utm_medium=feed) [2](https://hashnode.com/posts/remediate-emudhra-compromise/6adb7de8998dc4e227bcc277) [Victor Chukwuemeka Onwuegbuchulem](https://hashnode.com/@VickkyProgramming) · [Aug 14](https://hashnode.com/posts/tls-and-certificates-how-two-strangers-agree-on-a-secret-and-why-your-browser-trusts-anyone/6a7f3cf48f2065213c2c5c49) ### [TLS and Certificates: How Two Strangers Agree on a Secret, and Why Your Browser Trusts Anyone](https://victor-chukwuemeka.hashnode.dev/tls-and-certificates-how-two-strangers-agree-on-a-secret-and-why-your-browser-trusts-anyone?utm_source=hashnode&utm_medium=feed) Series: Networking Foundations | Post 8 of 14 In the last post, we said HTTPS wraps your connection in an encrypted tunnel called TLS. But that raises two questions that sound almost impossible when you first hear them. How do two machines that have never met, talking over a wire that anyone can listen to, agree on a secret key that the eavesdropper cannot learn? And how does your browser know the server on the other end is really who it claims to be, and not an impostor? This post answers both. It is the deep machinery of trust on the internet. 18 min read · [victor-chukwuemeka.hashnode.dev](https://victor-chukwuemeka.hashnode.dev/tls-and-certificates-how-two-strangers-agree-on-a-secret-and-why-your-browser-trusts-anyone?utm_source=hashnode&utm_medium=feed) [Renukashree Murali](https://hashnode.com/@quietbytes) · [Jul 16](https://hashnode.com/posts/building-a-pki-from-scratch-part-4-revocation-and-the-crl/6a584513efbbde2bde86fbac) ### [Building a PKI From Scratch, Part 4: Revocation and the CRL](https://quietbytes.hashnode.dev/building-a-pki-from-scratch-part-4-revocation-and-the-crl?utm_source=hashnode&utm_medium=feed) Revoking a cert, generating a CRL, and proving with openssl verify that a trusted chain gets correctly rejected once revoked. 6 min read · [quietbytes.hashnode.dev](https://quietbytes.hashnode.dev/building-a-pki-from-scratch-part-4-revocation-and-the-crl?utm_source=hashnode&utm_medium=feed) [Renukashree Murali](https://hashnode.com/@quietbytes) · [Jul 15](https://hashnode.com/posts/building-a-pki-from-scratch-part-3-issuing-a-certificate/6a57c3abb145da106f16550e) ### [Building a PKI From Scratch, Part 3: Issuing a Certificate and Proving the Chain Works](https://quietbytes.hashnode.dev/building-a-pki-from-scratch-part-3-issuing-a-certificate?utm_source=hashnode&utm_medium=feed) Issuing a server cert, proving the full chain with openssl verify, and the SAN + copy\_extensions gotchas that silently break TLS trust. 6 min read · [quietbytes.hashnode.dev](https://quietbytes.hashnode.dev/building-a-pki-from-scratch-part-3-issuing-a-certificate?utm_source=hashnode&utm_medium=feed) [Renukashree Murali](https://hashnode.com/@quietbytes) · [Jul 15](https://hashnode.com/posts/building-a-pki-from-scratch-part-2-the-intermediate-ca/6a57ba00843620ffc375bd0c) ### [Building a PKI from Scratch, Part 2: The Intermediate CA](https://quietbytes.hashnode.dev/building-a-pki-from-scratch-part-2-the-intermediate-ca?utm_source=hashnode&utm_medium=feed) Why real PKI never signs certs directly from the root — building an Intermediate CA by hand with OpenSSL, and the chain link that proves it. 6 min read · [quietbytes.hashnode.dev](https://quietbytes.hashnode.dev/building-a-pki-from-scratch-part-2-the-intermediate-ca?utm_source=hashnode&utm_medium=feed) [Renukashree Murali](https://hashnode.com/@quietbytes) · [Jul 13](https://hashnode.com/posts/pki-from-scratch-root-ca/6a56f1b9c111d291ab50d907) ### [Building a PKI From Scratch, Part 1: The Root CA](https://quietbytes.hashnode.dev/pki-from-scratch-root-ca?utm_source=hashnode&utm_medium=feed) Hand-building a Root Certificate Authority with OpenSSL and Python — the ledger, key policy, and self-signature mechanics behind it. 6 min read · [quietbytes.hashnode.dev](https://quietbytes.hashnode.dev/pki-from-scratch-root-ca?utm_source=hashnode&utm_medium=feed) [Padmanabhan Venkitasubramanian](https://hashnode.com/@padmanabhan) · [May 14](https://hashnode.com/posts/security-bouncycastle-x509-extension-encoding/6a05cffcbaf09db7a603e71e) ### [BouncyCastle X.509 Certificate Extensions in Java: A Subtle Encoding Trap](https://tvpadmanabhan.hashnode.dev/security-bouncycastle-x509-extension-encoding?utm_source=hashnode&utm_medium=feed) Fix common BouncyCastle X.509 extension errors in Java. Learn why getParsedValue works while getExtValue can cause encoding failures 3 min read · [tvpadmanabhan.hashnode.dev](https://tvpadmanabhan.hashnode.dev/security-bouncycastle-x509-extension-encoding?utm_source=hashnode&utm_medium=feed) [nine](https://hashnode.com/@xdsai) · [May 2](https://hashnode.com/posts/mtls-in-production-a-hands-on-guide-to-service-to-service-authentication-without-the-footguns/69f5d48e6d9768bebf2f737c) ### [mTLS in Production: A Hands-On Guide to Service-to-Service Authentication Without the Footguns](https://certpulse.hashnode.dev/mtls-in-production-a-hands-on-guide-to-service-to-service-authentication-without-the-footguns?utm_source=hashnode&utm_medium=feed) A practical, code-first walkthrough of implementing mutual TLS between services, including cert issuance, rotation, SPIFFE/SPIRE basics, and the failure modes nobody warns you about. 10 min read · [certpulse.hashnode.dev](https://certpulse.hashnode.dev/mtls-in-production-a-hands-on-guide-to-service-to-service-authentication-without-the-footguns?utm_source=hashnode&utm_medium=feed)