Introduction to certificates: behind the browser padlock
You learn what the browser padlock tells you, what is inside a certificate and how the chain of trust works; you create a signing request, get a certificate with ACME, install it on a web server, watch its expiry and recognise common errors.
Level 101 · 13 lessons · 12 practice labs
Lessons
What the padlock says
- What the padlock says and what it does not
- Inside a certificate: subject, issuer, validity, alternative names
- The chain of trust: like a notarised power of attorney
- Short task: inspect the certificates of three sites and draw their chains
Getting a certificate
- Creating a certificate signing request
- Validation types: domain, organisation, extended
- The ACME protocol and automatic certificates
- Installing a certificate on a web server
- Short task: install a certificate on the lab web server and verify it from the browser
Maintenance
- Expiry: the most common outage
- Common certificate errors and what they mean
- Introduction to certificate revocation
- Capstone: install, monitor and renew a lab site’s certificate
Practice labs
- Read a certificate's fields: Extract subject, issuer, validity dates and alternative names from the lab site's certificate and write a short ID card for it.
- Draw the certificate chain of three sites: Inspect the chains of three lab sites, draw each link from root to leaf and find the one missing an intermediate.
- Find and explain a certificate with a name mismatch: Check Gelincik Okulları's lab subdomains one by one, find the one whose certificate doesn't cover its name and propose the right alternative name list.
- Create a certificate signing request: Create a key and a signing request with the right alternative names for the lab site and verify the request's contents.
- Install a certificate on the lab web server and verify it: Install the certificate issued by the lab CA with its chain on the web server and show a client validates it without errors.
- Obtain a certificate via ACME and test renewal: Obtain a certificate from the lab ACME server, set up automatic renewal and verify with a forced renewal that the service serves the new certificate.
- Diagnose common certificate errors: Classify the error messages from four lab sites as expiry, name mismatch, untrusted issuer or incomplete chain.
- Find certificates about to expire: Collect end dates of the lab sites, list those expiring within 30 days and write a simple alert script.
- Detect a revoked certificate and replace it: Query the revocation status of the lab site's certificate, install a new one when you see it is revoked and show validation is fixed.
- Prepare a certificate watch list: Create a watch list for Kumsal Turizm's lab sites with owner, end date and renewal method columns.
- Renew an expiring certificate without downtime: Renew the expiring certificate on the lab web server, reload the service without downtime and verify the new end date.
- Install, monitor and renew a lab site's certificate: Install a certificate on a lab site, set up an expiry alert, trigger renewal and gather evidence of every step in one report.
About this course
You learn what the browser padlock tells you, what is inside a certificate and how the chain of trust works; you create a signing request, get a certificate with ACME, install it on a web server, watch its expiry and recognise common errors.
What you will learn
- What the padlock says
- Getting a certificate
- Maintenance
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.