Certificate Authority & PKI

Design, deploy, and operate the backbone of secure digital communication

⬢ ระดับ 3เทคนิค

+$80k-

ผลกระทบต่อเงินเดือน

15 เดือน

เวลาในการเรียนรู้

ยาก

ระดับความยาก

—

อาชีพ

ภาพรวม

PKI (Public Key Infrastructure) is the backbone of secure communication: designing CA hierarchies, issuing certificates, managing revocation (CRL/OCSP), and operating hardware security modules (HSMs). Enterprise PKI architects earn $180-250k. Mastery requires cryptography fundamentals + legal/compliance knowledge + DevOps chops. 12-18 month learning curve. Typical use: government agencies, financial institutions, healthcare requiring FIPS 140-2 HSM compliance.

Certificate Authority & PKI คืออะไร

PKI engineering is the highest-paid security specialty. Build CA hierarchies, manage key lifecycle, ensure compliance (FIPS, WebTrust). Gatekeeping skill for government and finance. Boost: +$80k-$120k

🔧 เครื่องมือและระบบนิเวศ

OpenSSL (certificate operations)Hardware Security Modules (Thales, YubiKey)EJBCA (enterprise CA software)HashiCorp Vault (CA as a service)certificate.transparency.dev (CT logs)OCSP Stapling (revocation)Python cryptography libraryCRL distribution systems

📋 ก่อนที่คุณจะเริ่มต้น

Cryptography Applied Engineering

💰 เงินเดือนตามภูมิภาค

ภูมิภาค	เจ้าหน้าที่จูเนียร์	ระดับกลาง	เจ้าหน้าที่อาวุโส
USA	$100k	$180k	$270k
UK	£80k	£150k	£230k
EU	€85k	€160k	€240k
CANADA	C$120k	C$210k	C$320k

🎓 ใบรับรอง

Cisco CCNA Security, PKI section GPEN (GIAC Pen Test), PKI attacks EJBCA Practitioner Certification

⚖ เปรียบเทียบกับ

Cryptography Applied Engineering

❓ คำถามที่พบบ่อย

What's the difference between self-signed, private CA, and public CA?

Self-signed: certificate signs itself, zero validation. Used in development only. Private CA: you (or your org) issues certs for internal use. Enterprise example: issue certs for internal APIs. Public CA: trusted by browsers (Let's Encrypt, DigiCert). Requires domain validation. Browser trust = expensive and slow.

Why would a company run its own CA instead of using Let's Encrypt?

Let's Encrypt = 90-day certs, limited validation. Private CA = custom validity periods (5+ years), more control, internal-only. Reasons: (1) internal services (not public), (2) compliance (HIPAA, SOX require audit trails), (3) performance (offline CA is more secure), (4) mTLS (mutual TLS) requiring client certificates.

What's certificate revocation and why is it hard?

Revocation = pulling a cert before expiration (e.g., leaked private key, employee left). Two methods: CRL (Certificate Revocation List, slow, large file) or OCSP (Online Certificate Status Protocol, real-time, requires always-online server). Hard because: browsers don't check revocation reliably, OCSP stapling adds complexity, false positives break everything.

What are Hardware Security Modules (HSMs)?

HSM = tamper-proof hardware device storing CA private keys (never extracted). Cost: $5k-50k. Required for: government contracts (FIPS 140-2), financial services, healthcare. HSM ensures: (1) key never touches unencrypted memory, (2) audit logs all CA operations, (3) tamper detection = immediate lockdown. Operational complexity = high.

How do I set up a CA hierarchy?

Typical 3-tier: Root CA (offline, air-gapped) → Intermediate CA (semi-online, hardware-backed) → Issuing CA (online, lower security). Root never sees day-to-day traffic. If Issuing CA compromised, revoke Intermediate, redeploy. Complexity: certificate chain building, cross-signing, migration between Intermediates.

What's certificate transparency and do I need it?

Certificate Transparency = public logs of all certs issued (CT logs). Google, browsers require it. Benefits: detect rogue/misissued certs, audit trail. Implementation: submit every cert to CT logs (2-3 independent), get back SCT (Signed Certificate Timestamp), include in cert. Mandatory for public CAs, optional for private.

What salary jump for PKI expertise?

Security engineer ($120-160k) → PKI architect ($200-280k). Scarcest skill: only ~500 people globally run enterprise CAs. Government contracts, financial services, aerospace = only buyers. If you master this, you'll never be unemployed. Remote contracts: $250-350/day common.