I was forced to learn some of it at work (using and signing medical payment transactions, with x509 certificates) so I have ar least a starting point. I have no idea how the revoke process works though, I can’t figure out a way that it functions without a central authority getting queried regularly. I thonk I can start without that knowledge though.

Anyway, with your information I’m up and running, thank you again!

“Derived certificates” not child certs, noted !