Mapped every skill to NIST CSF 2.0 subcategory IDs (GV/ID/PR/DE/RS/RC functions)
based on subdomain and content analysis. Restores 11 skills corrupted during
prior rebase, re-enriching with ATLAS, D3FEND, NIST AI RMF, and CSF 2.0 fields.
All 754 skills now carry structured mappings for all 5 security frameworks:
- MITRE ATT&CK (in tags)
- MITRE ATLAS v5.5 (atlas_techniques)
- MITRE D3FEND v1.3 (d3fend_techniques)
- NIST AI RMF 1.0 (nist_ai_rmf)
- NIST CSF 2.0 (nist_csf)
A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA +
cybersecurity
cryptography
cryptography
pki
certificate-authority
openssl
x509
1.0
mahipal
Apache-2.0
PR.DS-01
PR.DS-02
PR.DS-10
Configuring Certificate Authority with OpenSSL
Overview
A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA + Intermediate CA) using OpenSSL and the Python cryptography library, including CRL distribution, OCSP responder configuration, and certificate policy management.
When to Use
When deploying or configuring configuring certificate authority with openssl capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Objectives
Create a Root CA with self-signed certificate
Create an Intermediate CA signed by the Root CA
Issue server and client certificates from the Intermediate CA
Configure Certificate Revocation Lists (CRLs)
Implement certificate policies and constraints
Build a complete PKI hierarchy programmatically
Key Concepts
CA Hierarchy
Root CA (offline, air-gapped)
|
+-- Intermediate CA (online, operational)
|
+-- Server Certificates
+-- Client Certificates
+-- Code Signing Certificates
Certificate Extensions
Extension
Purpose
Critical
basicConstraints
CA:TRUE/FALSE, pathLenConstraint
Yes
keyUsage
keyCertSign, cRLSign, digitalSignature
Yes
extendedKeyUsage
serverAuth, clientAuth, codeSigning
No
subjectKeyIdentifier
Hash of public key
No
authorityKeyIdentifier
Issuer's key identifier
No
crlDistributionPoints
URL to CRL
No
authorityInfoAccess
OCSP responder URL
No
Security Considerations
Root CA private key must be stored offline (air-gapped HSM)
Use minimum 4096-bit RSA or P-384 ECDSA for CA keys
mukul975
efca3ec611