OFL-02 · Hardware Offload and Virtualization
Let the card encrypt, and measure what you saved.
Offload TLS to hardware, configure real servers to use it, and prove the throughput and CPU gains with numbers.
You build: a TLS offload setup with measured throughput and CPU figures.
Promise
Offload TLS to hardware, configure real servers to use it, and prove the throughput and CPU gains.
Prerequisites
basic cryptography; PDP-01 helpful.
Units
1. Cryptography and TLS ch 01–03
.
2. NIC crypto hardware ch 04–07
NIC architecture, crypto engines and key management, TLS offload principles, products.
3. Software integration ch 08–11
Linux crypto framework, DPDK crypto, OpenSSL engines, kernel TLS.
4. Configuration ch 12–13
nginx and HAProxy/Envoy offload.
5. Security and keys ch 14, 20, 21
key management, threat model, QUIC and HTTP/3 offload.
6. Performance ch 15–19
measurement and tuning, cloud deployment, observability, high availability.
7. Extended use ch 22–25
national cryptographic algorithms, storage encryption, custom offload.
8. Operations and future ch 26–28
fault diagnosis, cost–benefit, outlook.
9. Labs ch 29–30
a TLS-offload web cluster and a high-performance secure API gateway.
Labs
Each lab names its environment and a pass check. Labs are not marked complete on "it ran" — the pass check has to hold.
| Lab | What you do | Environment |
|---|---|---|
| OFL-02ach 11 | Enable kTLS and send dataPass check: `ss` shows the TLS ULP | sim60 min |
| OFL-02bch 12 | nginx with TLS and a session checkPass check: Handshake succeeds and cipher is recorded | vm90 min |
| OFL-02cch 16 | Throughput and CPU with and without offloadPass check: Table with both runs | hardware90 min |
| OFL-02dch 29 | TLS-offload web clusterPass check: Load test passes | vm180 min |
Capstone project · CAP-05
Security Gateway Design with Compliance Map · 2 weeks
A regulated customer needs an access gateway for internal APIs.
Write the design: policy decision and enforcement points, data path, performance budget, and a control-to-regulation map for two clauses.
Deliverables: Design document, policy test suite, compliance map.
Outcomes
- I can explain what a crypto NIC does that a CPU engine cannot.
- I can switch a web server to hardware TLS and check it is active.
- I can compare CPU use before and after offload.
Also in
How it runs
Work through the units in order. Each unit groups the chapters of the study guide with its share of the labs. You can start any time; there is no cohort date and nothing expires.
Labs run in a VM, a container, a simulator or on real hardware, and the card above names which. Where a lab needs hardware — an RDMA NIC, a programmable switch model, an FPGA — there is a simulator fallback so you are never blocked by equipment.
Questions
Do I get a certificate?
You get a completion record for the course. Path badges and project credentials are earned by passing the labs and the project review, not by attendance.
Can my team take this together?
Yes — and if you would rather have it delivered live, with the instructor in the room, this course also exists as a scheduled live cohort. See the live dates.
How long does it take?
≈ 30 h of study including the labs. Most engineers take it part-time over a few weeks.