Lesson 5.3: Certificates and PKI
A certificate binds a public key to a name and is signed by a certificate authority that browsers and systems already trust. How the chain from a site's certificate up to a root works, what the subject, issuer, validity dates and Subject Alternative Names mean, how fingerprints identify a certificate, why expiry is the most common certificate outage, and how Certificate Transparency and short-lived automated certificates (ACME, Let's Encrypt) changed the web. In the lab you inspect the shop's certificate with openssl x509, set up an expiry check, and find an internal VPN certificate that has already expired.
17 min
You will learn to
- Explain what a certificate and a certificate authority are
- Read subject, issuer, validity and SAN
- Explain the chain of trust
- Check expiry with -checkend
- Explain Certificate Transparency and automated renewal
Key terms
- Certificate (X.509)
- A signed document that binds a public key to a name (a domain, a person, an organisation) for a period of time.
- Certificate authority (CA)
- An organisation that checks identities and signs certificates.
- Chain of trust
- Site certificate ← signed by an intermediate CA ← signed by a root CA in the trust store.
- Subject Alternative Name (SAN)
- The list of names a certificate is valid for.
- Certificate Transparency (CT)
- Public append-only logs of every certificate issued by trusted CAs.
- ACME
- A protocol for requesting and renewing certificates automatically (RFC 8555).
← Path traversal and command injection · All lessons · Authentication, authorisation, accounting and MFA →