Cyber Security Academy · Lesson

Managing Certificates

Issue, renew, revoke.

Managing Certificates is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

The Certificate Lifecycle

Certificates are not set-and-forget. They move through a lifecycle: request, issue, deploy, monitor, renew, and revoke.

Managing this lifecycle well prevents outages and security gaps.

Generating a Key and CSR

Issuance starts with a private key and a Certificate Signing Request (CSR).

openssl req -new -newkey rsa:2048 -nodes \
  -keyout server.key -out server.csr \
  -subj '/CN=app.example.com'

Submitting for Issuance

The CSR is sent to a CA. After validating your identity, the CA returns a signed certificate.

With ACME-based CAs, this whole step is automated by a client like Certbot.

certbot certonly --standalone -d app.example.com

Deploying a Certificate

Once issued, the certificate and its full chain are installed on the server (web server, load balancer, etc.) alongside the private key.

The private key must have strict permissions so only the service can read it.

chmod 600 server.key
chown www-data:www-data server.key

Monitoring Expiry

Expired certificates cause sudden outages and browser warnings. Always monitor expiry dates.

openssl x509 -in server.crt -noout -enddate

Renewing Certificates

Renewal issues a fresh certificate before the old one expires.

Automate it. ACME clients can renew unattended and reload the service.

certbot renew --quiet --post-hook 'systemctl reload nginx'

Why Revoke?

Revocation declares a certificate invalid before its expiry. You revoke when:

The private key is compromised.
The certificate was mis-issued.
The service is decommissioned.

CRL vs OCSP

Clients check revocation in two main ways:

CRL (Certificate Revocation List): a published list of revoked serial numbers.
OCSP (Online Certificate Status Protocol): a real-time query for a single certificate's status.

OCSP Stapling

OCSP stapling lets the server fetch its own signed OCSP response and attach it to the TLS handshake.

This speeds things up and protects user privacy, since the client no longer queries the CA directly.

openssl s_client -connect example.com:443 -status

Short Lifetimes and Automation

The industry is moving toward short-lived certificates (90 days or less).

Shorter lifetimes limit damage from undetected compromise and force healthy automation, reducing reliance on slow revocation.

Inventory and Ownership

Large organizations track every certificate in an inventory: where it lives, who owns it, and when it expires.

Unknown or orphaned certificates are a frequent cause of surprise outages.

Quick Check

A server's private key is leaked. The certificate is still valid for another 60 days. What should you do?

Recap

You learned to manage the certificate lifecycle end to end.

Issue via CSR, deploy with the full chain and protected keys.
Renew automatically before expiry.
Revoke via CRL or OCSP when keys are compromised.
Keep a full inventory.

Next module: a deep dive into TLS and SSL.

Frequently asked questions

Is the “Managing Certificates” lesson free?

Yes — the full text of “Managing Certificates” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Managing Certificates”?

Issue, renew, revoke. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Managing Certificates” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy