Question 1

What's the difference between self-signed, private CA, and public CA?

Accepted Answer

Self-signed: certificate signs itself, zero validation. Used in development only. Private CA: you (or your org) issues certs for internal use. Enterprise example: issue certs for internal APIs. Public CA: trusted by browsers (Let's Encrypt, DigiCert). Requires domain validation. Browser trust = expensive and slow.

Question 2

Why would a company run its own CA instead of using Let's Encrypt?

Accepted Answer

Let's Encrypt = 90-day certs, limited validation. Private CA = custom validity periods (5+ years), more control, internal-only. Reasons: (1) internal services (not public), (2) compliance (HIPAA, SOX require audit trails), (3) performance (offline CA is more secure), (4) mTLS (mutual TLS) requiring client certificates.

Question 3

What's certificate revocation and why is it hard?

Accepted Answer

Revocation = pulling a cert before expiration (e.g., leaked private key, employee left). Two methods: CRL (Certificate Revocation List, slow, large file) or OCSP (Online Certificate Status Protocol, real-time, requires always-online server). Hard because: browsers don't check revocation reliably, OCSP stapling adds complexity, false positives break everything.

Question 4

What are Hardware Security Modules (HSMs)?

Accepted Answer

HSM = tamper-proof hardware device storing CA private keys (never extracted). Cost: $5k-50k. Required for: government contracts (FIPS 140-2), financial services, healthcare. HSM ensures: (1) key never touches unencrypted memory, (2) audit logs all CA operations, (3) tamper detection = immediate lockdown. Operational complexity = high.

Question 5

How do I set up a CA hierarchy?

Accepted Answer

Typical 3-tier: Root CA (offline, air-gapped) → Intermediate CA (semi-online, hardware-backed) → Issuing CA (online, lower security). Root never sees day-to-day traffic. If Issuing CA compromised, revoke Intermediate, redeploy. Complexity: certificate chain building, cross-signing, migration between Intermediates.

Question 6

What's certificate transparency and do I need it?

Accepted Answer

Certificate Transparency = public logs of all certs issued (CT logs). Google, browsers require it. Benefits: detect rogue/misissued certs, audit trail. Implementation: submit every cert to CT logs (2-3 independent), get back SCT (Signed Certificate Timestamp), include in cert. Mandatory for public CAs, optional for private.

Question 7

What salary jump for PKI expertise?

Accepted Answer

Security engineer ($120-160k) → PKI architect ($200-280k). Scarcest skill: only ~500 people globally run enterprise CAs. Government contracts, financial services, aerospace = only buyers. If you master this, you'll never be unemployed. Remote contracts: $250-350/day common.

प्रदेश	ज्युनियर	मध्यम	सीनियर
USA	$100k	$180k	$270k
UK	£80k	£150k	£230k
EU	€85k	€160k	€240k
CANADA	C$120k	C$210k	C$320k

Certificate Authority & PKI

Certificate Authority & PKI म्हणजे काय

📋 सुरू करण्यापूर्वी

💰 प्रदेशानुसार पगार

🎓 प्रमाणपत्रे

⚖ यांच्याशी तुलना करा

❓ FAQ

हे कौशल्य तुमच्यासाठी योग्य आहे का, याची खात्री नाही?

तुमचा आदर्श करिअर मार्ग शोधा