Every service you run authenticates to something. Most of them do it with a string in an environment variable, a password, an API key, a token, and that string has three problems: it leaks, it never rotates, and it proves nothing about who is holding it.

The usual answer is a secret manager. But a secret manager needs a credential to talk to, and so does whatever fetches that one. This is secret zero: the bootstrap credential at the bottom of the stack that nothing can protect.

This course removes it, one layer at a time. You will build a certificate authority and watch a verifier decide whether to trust it. You will bind a database login to a specific certificate subject, then break it. You will cut certificate lifetimes to thirty seconds and see why revocation stopped mattering. You will move a CA key into an HSM where it cannot be copied, and prove a key lives in one specific TPM. Finally you will wire all of it into a single enrollment flow, and attack it three ways.

Everything runs on real tools, openssl, cfssl, MariaDB, SoftHSM2, swtpm, tpm2-tools. Nothing is mocked, and where the emulated hardware falls short of the real thing, the labs say so explicitly rather than pretending.

By the end, SPIFFE and SPIRE will not look like magic. They will look like the obvious thing to build once you have built it yourself.