Besu Certified Professional study plan
Besu Certified Professional · Give each week a clear focus.
8 weeks · About 7 hours per week
Hyperledger Besu Architecture and Deployment & Network Configuration and Genesis Files
Install Besu from a binary distribution and from a container image, then start a single dev-mode node and confirm it produces blocks via eth_blockNumber polling.
Map the Besu directory layout (data path, key files, logs, config) by inspecting a running node and writing a one-page annotated tree of every file that matters for operations.
Draft a genesis file from scratch that sets chainId, alloc, difficulty, gasLimit, and a QBFT or IBFT 2.0 block period, then boot a private network of four validators from it.
Explain in writing how genesis parameters propagate to block validation and why a mismatched genesis causes peers to silently reject each other.
Your checkpoint
A working 4-validator private network launched from a hand-written genesis file, plus a committed repo containing the genesis, validator key config, and a README with the exact start commands.
Consensus Protocols (PoW, PoA, IBFT 2.0, QBFT) & Network Configuration and Genesis Files
Compare PoW (Ethash), PoA (Clique), IBFT 2.0, and QBFT on finality, validator set changes, fork behavior, and liveness requirements, producing a comparison table with at least eight rows.
Configure a QBFT network with a rotating validator set and demonstrate adding and removing a validator through the JSON-RPC validator methods.
Tune block period and request timeout parameters and observe the effect on block production latency under load.
Diagnose a stalled consensus by killing enough validators to break quorum, capture the log signatures of the stall, then restore quorum and document recovery.
Your checkpoint
A consensus comparison table plus a lab log showing a QBFT validator add/remove cycle and a reproduced and recovered quorum-loss incident with relevant log excerpts.
Node Operations, Monitoring, and Troubleshooting & Hyperledger Besu Architecture and Deployment
Expose and scrape Besu Prometheus metrics and build a dashboard covering block height, peer count, transaction pool size, and JVM heap.
Configure log levels per package and rotate logs, then locate the specific log lines that indicate peer discovery failure versus consensus failure.
Practice the operational lifecycle: graceful shutdown, data directory backup, resync from scratch, and restoring a node from backup.
Benchmark node startup time and disk growth under sustained transaction load and record the numbers.
Your checkpoint
A monitoring bundle: Prometheus scrape config, a dashboard definition with the four required panels, and a troubleshooting runbook mapping five symptom categories to concrete log evidence and fixes.
JSON-RPC API and EVM Interaction & Smart Contract Development and Deployment
Exercise the JSON-RPC surface end to end: eth, net, web3, admin, debug, and txpool namespaces, including enabling non-default namespaces safely via host allowlists.
Deploy a contract with a development toolchain and interact with it through raw JSON-RPC calls (eth_sendRawTransaction, eth_call, eth_getLogs) without using the toolchain's abstraction layer.
Trace a failing transaction with debug_traceTransaction and identify the revert reason and gas consumption at the failing opcode.
Subscribe to new heads and logs over WebSocket and write a small listener that reacts to contract events.
Your checkpoint
A scripted end-to-end demo that deploys a contract, sends a transaction, traces it, and prints decoded events from a WebSocket subscription, with the raw RPC payloads saved as fixtures.
Privacy and Permissioning & Security, Key Management, and TLS
Configure onchain permissioning with permissioning contract addresses and demonstrate that a non-allowlisted account is rejected at transaction submission.
Set up node-level permissioning using an accounts allowlist and a nodes allowlist, and verify an unauthorized node cannot peer.
Enable TLS on the JSON-RPC endpoint with a self-signed certificate chain and connect a client that validates the certificate.
Store validator and node keys securely, document the key hierarchy, and describe how to rotate a node key without losing peer identity trust.
Your checkpoint
A permissioning and TLS lab report showing four enforced denials (account, node, RPC without TLS, RPC with untrusted cert) each backed by the exact error returned.
Smart Contract Development and Deployment & JSON-RPC API and EVM Interaction
Write and test a contract that uses precompiles or Besu-specific behavior, verifying gas costs against measured values.
Estimate gas with eth_estimateGas and reconcile the estimate against actual usage for storage-heavy operations.
Deploy the same contract bytecode across two chains with different chainIds and confirm replay protection by attempting a cross-chain replay.
Automate contract deployment and verification in a CI-style script that fails on any RPC error.
Your checkpoint
A contract repository with tests, a deployment script parameterized by chainId and RPC endpoint, and a measured gas report comparing estimates to actual consumption.
Upgrades, Migration, and Interoperability & Node Operations, Monitoring, and Troubleshooting
Perform a node upgrade across a major version boundary, including database migration, and record rollback steps.
Export and import chain data between two Besu nodes and verify block height and state root match after import.
Connect a Besu node to a network running a different client and confirm block propagation and finality.
Write a migration checklist covering genesis changes, fork blocks, validator key continuity, and peer compatibility.
Your checkpoint
An upgrade and migration runbook validated by an actual version upgrade and a cross-client peering test, with before/after block heights and state roots recorded.
Consensus Protocols (PoW, PoA, IBFT 2.0, QBFT) & Privacy and Permissioning & Security, Key Management, and TLS
Re-run the two heaviest labs (QBFT validator management and permissioning enforcement) from memory without notes and log every stumble.
Complete two timed mock exams weighted by domain percentage and review every wrong answer to a root cause.
Close knowledge gaps by rewriting weak-area notes into question-and-answer form and self-quizzing until recall is fluent.
Verify operational fluency by rebuilding the week 1 network from a clean machine in under 30 minutes.
Your checkpoint
A scored mock-exam record with a gap-closure log, plus a timed clean-machine rebuild of the private network proving end-to-end retention.
Milestones
Week 2: You can explain finality and quorum differences between IBFT 2.0 and QBFT without notes and have produced a block on a network you configured yourself.
Week 4: You can deploy, call, trace, and subscribe to a contract using only documented JSON-RPC methods and read the resulting traces.
Week 6: You can enforce and prove denial for both account-level and node-level permissioning, and terminate TLS on the RPC endpoint with a validated certificate.
Week 8: You score at least 80 percent on both weighted mock exams and rebuild the private network from scratch within 30 minutes.