I feel similarly frustrated. The basics of CAs, trust chains and certificates are pretty easy to understand once you're roughly aware of public key cryptograph

I feel similarly frustrated. The basics of CAs, trust chains and certificates are pretty easy to understand once you're roughly aware of public key cryptography. But then you get into the arcane and confusing details of which fields hold which information, the various serialization formats, confusing error messages when servers don't provide their intermediates, other software simply not dealing with intermediates (I'm looking at you, etcd) and on and on. A "fun" example: I have an openvpn client config that contains, among other things, this here: <pkcs12> -----BEGIN CERTIFICATE----- (base64-looking stuff here) -----END CERTIFICATE----- </pkcs12> This contains, confusingly, not just a certificate but also an encrypted private key. I wanted to change the encryption password, but it turns out that "openssl pkcs12" cannot actually read that block, because it turns out to be a base64-encoded DER format or some other shit. WAT?