Cryptography › Module 3 › Lesson 4
Lab — Analyze SSL Certificate
Inspect a live HTTPS certificate with openssl and curl copy-paste commands
Opening
Read a real cert like an analyst
Pick a site you are allowed to probe (example.com or your own domain). Extract subject, issuer, and dates. This is defensive reconnaissance of your own TLS posture—not attacking others.
1. Step 1 — Fetch certificate details
OpenSSL — subject, issuer, dates (Git Bash / WSL / Linux / macOS)openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
Windows-friendly alternative — save PEM then inspectopenssl s_client -connect example.com:443 -servername example.com # In another terminal after saving the PEM block to cert.pem: openssl x509 -in cert.pem -noout -text
openssl s_client -connect example.com:443 -servername example.com # In another terminal after saving the PEM block to cert.pem: openssl x509 -in cert.pem -noout -text
2. Step 2 — Quick HTTPS header check
curl TLS + response headerscurl -vI --connect-timeout 10 https://example.com 2>&1 | more
curl -vI --connect-timeout 10 https://example.com 2>&1 | more
3. What to Write Down
Record: matching hostname (SAN)? Issuer CA? Not-after expiry date? Any TLS warnings? Challenge: compare example.com with your own site and note differences in chain length or validity period.
Complete SSL certificate lab
Run the openssl (or equivalent) inspection on an allowed HTTPS host and note subject, issuer, SANs, and expiry.
Knowledge Check
openssl x509 -noout -dates shows:
Multiple choice
Knowledge Check
True or False: You should only run these probes against hosts you are allowed to test.
True or False