Appendix J: References

References & Further Reading

Curated list of authoritative resources for deepening your PKI and certificate knowledge.

Standards & RFCs

Core PKI Standards

• RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and CRL Profile https://datatracker.ietf.org/doc/html/rfc5280

• RFC 6960 - Online Certificate Status Protocol (OCSP) https://datatracker.ietf.org/doc/html/rfc6960

• RFC 6962 - Certificate Transparency https://datatracker.ietf.org/doc/html/rfc6962

• RFC 8555 - Automatic Certificate Management Environment (ACME) https://datatracker.ietf.org/doc/html/rfc8555

• RFC 7030 - Enrollment over Secure Transport (EST) https://datatracker.ietf.org/doc/html/rfc7030

TLS/SSL

• RFC 8446 - The Transport Layer Security (TLS) Protocol Version 1.3 https://datatracker.ietf.org/doc/html/rfc8446

• RFC 6125 - Representation and Verification of Domain-Based Application Service Identity https://datatracker.ietf.org/doc/html/rfc6125

Cryptographic Algorithms

• RFC 3447 - RSA Cryptography Specifications (PKCS #1 v2.1) https://datatracker.ietf.org/doc/html/rfc3447

• RFC 6090 - Fundamental Elliptic Curve Cryptography Algorithms https://datatracker.ietf.org/doc/html/rfc6090

• FIPS 186-5 - Digital Signature Standard (DSS) https://csrc.nist.gov/publications/detail/fips/186/5/final

Industry Guidelines

CA/Browser Forum

• Baseline Requirements for TLS Certificates https://cabforum.org/baseline-requirements-documents/

• EV SSL Certificate Guidelines https://cabforum.org/extended-validation/

NIST Publications

• SP 800-57 - Recommendation for Key Management https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final

• SP 800-207 - Zero Trust Architecture https://csrc.nist.gov/publications/detail/sp/800-207/final

• SP 800-52 Rev. 2 - Guidelines for TLS Implementations https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final

ETSI Standards

• ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates https://www.etsi.org/standards

Books

Foundational

• “Network Security with OpenSSL” by Pravir Chandra, Matt Messier, John Viega O’Reilly, 2002 - Comprehensive OpenSSL guide

• “PKI Uncovered” by Andre Karamanian, Siva Sathianathan Cisco Press, 2011 - Enterprise PKI design patterns

• “Bulletproof SSL and TLS” by Ivan Ristic Feisty Duck, 2022 - Authoritative guide to deploying TLS correctly

Advanced

• “Serious Cryptography” by Jean-Philippe Aumasson No Starch Press, 2017 - Modern cryptographic algorithms and protocols

• “Applied Cryptography” by Bruce Schneier Wiley, 1996 - Classic text on cryptographic protocols

Online Resources

Documentation

• OpenSSL Documentation https://www.openssl.org/docs/

• Let’s Encrypt Documentation https://letsencrypt.org/docs/

• cert-manager Documentation https://cert-manager.io/docs/

• HashiCorp Vault PKI Secrets Engine https://www.vaultproject.io/docs/secrets/pki

• FreeIPA Documentation https://www.freeipa.org/page/Documentation

Testing Tools

• SSL Labs Server Test https://www.ssllabs.com/ssltest/ Test HTTPS server configuration and certificate chain

• testssl.sh https://testssl.sh/ Command-line TLS/SSL testing tool

• crt.sh - Certificate Search https://crt.sh/ Query Certificate Transparency logs

• Hardenize https://www.hardenize.com/ Comprehensive TLS/PKI scanner

Tutorials & Blogs

• Cloudflare Learning Center - SSL/TLS https://www.cloudflare.com/learning/ssl/

• Mozilla SSL Configuration Generator https://ssl-config.mozilla.org/ Generate secure TLS configs for common servers

• PKI Solutions Blog https://pkisolutions.com/blog/ Enterprise PKI insights

Videos & Courses

• “Public Key Cryptography” (Khan Academy) Introduction to RSA and key exchange

• “How HTTPS Works” (Cloudflare YouTube) Animated explanation of TLS handshake

• Pluralsight - “PKI Architecture and Implementation” Comprehensive video course on enterprise PKI

Software & Tools

CA Software

• OpenSSL - https://www.openssl.org/
• FreeIPA - https://www.freeipa.org/
• EJBCA - https://www.ejbca.org/
• step-ca - https://smallstep.com/docs/step-ca
• HashiCorp Vault - https://www.vaultproject.io/

Certificate Management

• cert-manager (Kubernetes) - https://cert-manager.io/
• Certbot (ACME client) - https://certbot.eff.org/
• certmonger (RHEL) - https://pagure.io/certmonger
• Venafi (Enterprise) - https://www.venafi.com/

Libraries

• BouncyCastle (Java/C#) - https://www.bouncycastle.org/
• cryptography (Python) - https://cryptography.io/
• Go crypto/x509 - https://pkg.go.dev/crypto/x509

Communities & Forums

• Let’s Encrypt Community Forum https://community.letsencrypt.org/

• r/crypto (Reddit) https://www.reddit.com/r/crypto/

• r/netsec (Reddit) https://www.reddit.com/r/netsec/

• IETF TLS Working Group https://datatracker.ietf.org/wg/tls/about/

Research Papers

• “The Most Dangerous Code in the World” (Martin et al., 2012) Analysis of SSL certificate validation vulnerabilities

• “Analysis of the HTTPS Certificate Ecosystem” (Durumeric et al., IMC 2013) Large-scale study of TLS deployment

• “SoK: SSL and HTTPS Revisiting past challenges and evaluating certificate trust model enhancements” (Clark & van Oorschot, S&P 2013)

Compliance Frameworks

• PCI DSS - Payment Card Industry Data Security Standard https://www.pcisecuritystandards.org/

• HIPAA - Health Insurance Portability and Accountability Act https://www.hhs.gov/hipaa/

• SOC 2 - Service Organization Control 2 https://www.aicpa.org/

• eIDAS - EU electronic identification and trust services https://digital-strategy.ec.europa.eu/en/policies/eidas-regulation

Stay Updated: PKI and TLS standards evolve continuously. Subscribe to the IETF TLS working group mailing list and follow security advisories from your CA and software vendors.