Certificate Authority & PKI

Design, deploy, and operate the backbone of secure digital communication

⬢ স্তর 3প্রযুক্তিগত

+$80k-

বেতনের প্রভাব

15 মাস

শেখার সময়

কঠিন

কঠিনতা

—

ক্যারিয়ার

এক নজরে

PKI (Public Key Infrastructure) is the backbone of secure communication: designing CA hierarchies, issuing certificates, managing revocation (CRL/OCSP), and operating hardware security modules (HSMs). Enterprise PKI architects earn $180-250k. Mastery requires cryptography fundamentals + legal/compliance knowledge + DevOps chops. 12-18 month learning curve. Typical use: government agencies, financial institutions, healthcare requiring FIPS 140-2 HSM compliance.

Certificate Authority & PKI কী

PKI engineering is the highest-paid security specialty. Build CA hierarchies, manage key lifecycle, ensure compliance (FIPS, WebTrust). Gatekeeping skill for government and finance. Boost: +$80k-$120k

🔧 সরঞ্জাম এবং ইকোসিস্টেম

OpenSSL (certificate operations)Hardware Security Modules (Thales, YubiKey)EJBCA (enterprise CA software)HashiCorp Vault (CA as a service)certificate.transparency.dev (CT logs)OCSP Stapling (revocation)Python cryptography libraryCRL distribution systems

📋 শুরু করার আগে

Cryptography Applied Engineering

💰 অঞ্চল অনুযায়ী বেতন

অঞ্চল	জুনিয়র	মধ্য	সিনিয়র
USA	$100k	$180k	$270k
UK	£80k	£150k	£230k
EU	€85k	€160k	€240k
CANADA	C$120k	C$210k	C$320k

🎓 সার্টিফিকেশন

Cisco CCNA Security, PKI section GPEN (GIAC Pen Test), PKI attacks EJBCA Practitioner Certification

⚖ এর সাথে তুলনা করুন

Cryptography Applied Engineering

❓ প্রায়শই জিজ্ঞাসিত প্রশ্ন

What's the difference between self-signed, private CA, and public CA?

Self-signed: certificate signs itself, zero validation. Used in development only. Private CA: you (or your org) issues certs for internal use. Enterprise example: issue certs for internal APIs. Public CA: trusted by browsers (Let's Encrypt, DigiCert). Requires domain validation. Browser trust = expensive and slow.

Why would a company run its own CA instead of using Let's Encrypt?

Let's Encrypt = 90-day certs, limited validation. Private CA = custom validity periods (5+ years), more control, internal-only. Reasons: (1) internal services (not public), (2) compliance (HIPAA, SOX require audit trails), (3) performance (offline CA is more secure), (4) mTLS (mutual TLS) requiring client certificates.

What's certificate revocation and why is it hard?

Revocation = pulling a cert before expiration (e.g., leaked private key, employee left). Two methods: CRL (Certificate Revocation List, slow, large file) or OCSP (Online Certificate Status Protocol, real-time, requires always-online server). Hard because: browsers don't check revocation reliably, OCSP stapling adds complexity, false positives break everything.

What are Hardware Security Modules (HSMs)?

HSM = tamper-proof hardware device storing CA private keys (never extracted). Cost: $5k-50k. Required for: government contracts (FIPS 140-2), financial services, healthcare. HSM ensures: (1) key never touches unencrypted memory, (2) audit logs all CA operations, (3) tamper detection = immediate lockdown. Operational complexity = high.

How do I set up a CA hierarchy?

Typical 3-tier: Root CA (offline, air-gapped) → Intermediate CA (semi-online, hardware-backed) → Issuing CA (online, lower security). Root never sees day-to-day traffic. If Issuing CA compromised, revoke Intermediate, redeploy. Complexity: certificate chain building, cross-signing, migration between Intermediates.

What's certificate transparency and do I need it?

Certificate Transparency = public logs of all certs issued (CT logs). Google, browsers require it. Benefits: detect rogue/misissued certs, audit trail. Implementation: submit every cert to CT logs (2-3 independent), get back SCT (Signed Certificate Timestamp), include in cert. Mandatory for public CAs, optional for private.

What salary jump for PKI expertise?

Security engineer ($120-160k) → PKI architect ($200-280k). Scarcest skill: only ~500 people globally run enterprise CAs. Government contracts, financial services, aerospace = only buyers. If you master this, you'll never be unemployed. Remote contracts: $250-350/day common.