Cryptography › Module 3 › Lesson 2
SSL Certificates
Read certificate fields: subject, issuer, validity, and SANs that browsers check
Opening
Read the passport, not just the flag
People say “SSL certificate” even on modern TLS. The file is an X.509 certificate. Learning a few fields turns scary browser errors into actionable checks.
1. Fields You Should Recognize
Subject / CN / SAN
Which hostnames the cert covers. SANs (Subject Alternative Names) matter most today.
Issuer
Which CA signed it.
Validity Not Before / Not After
Expired or not-yet-valid certs break trust.
Public key
The key browsers use in the handshake.
Peek at a remote certificate (OpenSSL)openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
On Windows PowerShell you can still use OpenSSL if installed, or inspect via browser → padlock → certificate viewer. Match the hostname you typed to SAN entries.
Name mismatch = stop
If you visit bank.example but the cert is for something else, do not continue—even if the UI looks familiar.
Knowledge Check
SANs on a certificate list:
Multiple choice
Knowledge Check
True or False: An expired certificate should fail browser trust checks.
True or False
Knowledge Check
The issuer field tells you:
Multiple choice