I've found it ok to understand maybe 70% of PKI, but that I always need to review that last 30% (OSCP stapling, cross signing certs, whatever the heck the formats are, different extensions, more that I'm forgetting).

I've put my favorite learning resources and tools into https://www.bbkane.com/blog/learn-ssl/