JobCannon
Dandeettiiwwan hundaa

Certificate Authority & PKI

Design, deploy, and operate the backbone of secure digital communication

⬢ SADARKAA 3Teeknikaalaa
+$80k-
Dhiibbaa miindaa
Ji'oota 15
Yeroo barachuuf fudhatu
Ulfaataa
Sadarkaa rakkinaa
—
Hojiiwwan Ogummaa
Gabaabinaan

PKI (Public Key Infrastructure) is the backbone of secure communication: designing CA hierarchies, issuing certificates, managing revocation (CRL/OCSP), and operating hardware security modules (HSMs). Enterprise PKI architects earn $180-250k. Mastery requires cryptography fundamentals + legal/compliance knowledge + DevOps chops. 12-18 month learning curve. Typical use: government agencies, financial institutions, healthcare requiring FIPS 140-2 HSM compliance.

Certificate Authority & PKI maali?

PKI engineering is the highest-paid security specialty. Build CA hierarchies, manage key lifecycle, ensure compliance (FIPS, WebTrust). Gatekeeping skill for government and finance. Boost: +$80k-$120k

🔧 MEESHAALEE & SIRNA NAANNOO
OpenSSL (certificate operations)Hardware Security Modules (Thales, YubiKey)EJBCA (enterprise CA software)HashiCorp Vault (CA as a service)certificate.transparency.dev (CT logs)OCSP Stapling (revocation)Python cryptography libraryCRL distribution systems

📋 Osoo hin jalqabin dura

Cryptography Applied Engineering

💰 Miindaa naannoodhaan

NaannooJalqabaaGiddu-galeessaAngafa
USA$100k$180k$270k
UK£80k£150k£230k
EU€85k€160k€240k
CANADAC$120kC$210kC$320k

❓ Gaaffiiwwan Deddeebi'an

What's the difference between self-signed, private CA, and public CA?
Self-signed: certificate signs itself, zero validation. Used in development only. Private CA: you (or your org) issues certs for internal use. Enterprise example: issue certs for internal APIs. Public CA: trusted by browsers (Let's Encrypt, DigiCert). Requires domain validation. Browser trust = expensive and slow.
Why would a company run its own CA instead of using Let's Encrypt?
Let's Encrypt = 90-day certs, limited validation. Private CA = custom validity periods (5+ years), more control, internal-only. Reasons: (1) internal services (not public), (2) compliance (HIPAA, SOX require audit trails), (3) performance (offline CA is more secure), (4) mTLS (mutual TLS) requiring client certificates.
What's certificate revocation and why is it hard?
Revocation = pulling a cert before expiration (e.g., leaked private key, employee left). Two methods: CRL (Certificate Revocation List, slow, large file) or OCSP (Online Certificate Status Protocol, real-time, requires always-online server). Hard because: browsers don't check revocation reliably, OCSP stapling adds complexity, false positives break everything.
What are Hardware Security Modules (HSMs)?
HSM = tamper-proof hardware device storing CA private keys (never extracted). Cost: $5k-50k. Required for: government contracts (FIPS 140-2), financial services, healthcare. HSM ensures: (1) key never touches unencrypted memory, (2) audit logs all CA operations, (3) tamper detection = immediate lockdown. Operational complexity = high.
How do I set up a CA hierarchy?
Typical 3-tier: Root CA (offline, air-gapped) → Intermediate CA (semi-online, hardware-backed) → Issuing CA (online, lower security). Root never sees day-to-day traffic. If Issuing CA compromised, revoke Intermediate, redeploy. Complexity: certificate chain building, cross-signing, migration between Intermediates.
What's certificate transparency and do I need it?
Certificate Transparency = public logs of all certs issued (CT logs). Google, browsers require it. Benefits: detect rogue/misissued certs, audit trail. Implementation: submit every cert to CT logs (2-3 independent), get back SCT (Signed Certificate Timestamp), include in cert. Mandatory for public CAs, optional for private.
What salary jump for PKI expertise?
Security engineer ($120-160k) → PKI architect ($200-280k). Scarcest skill: only ~500 people globally run enterprise CAs. Government contracts, financial services, aerospace = only buyers. If you master this, you'll never be unemployed. Remote contracts: $250-350/day common.

Dandeettiin kun isiniif ta'uu isaa hin beektanii?

Wal-gita Hojii fudhadhaa — daandiiwwan sirrii isiniif yaada kennina.

Dandeettiiwwan naaf mijatan argadhaa →

Daandii ogummaa keessan isa gaarii argadhaa

Hojiiwwan ogummaa 2,521 keessaa wal-madaalchisuu dandeettii irratti hundaa'e. Tola.

Wal-gita Hojii fudhadhaa — tola →