I once built and maintained a CA with Helma and OpenSSL.

Filling in the Gaps: HTTPS/TLS Certificates.

The goal here is to show how certs work at the most basic conceptual level, without straying too far into RFCs and X.509 and what have you.