Typorithm · hard

TLS & PKI

tls-pkisecuritytlspkicertificate

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn TLS & PKI

Cryptography

PKI uses Certificate Authorities to sign certificates that bind an identity to a public key. A CSR requests a cert. TLS presents the cert chain and derives session keys via ECDHE, and the client verifies the chain back to a trusted root.

Public Key Infrastructure (PKI) lets you trust a stranger's public key. A Certificate Authority (CA) signs a certificate that binds an identity (like a domain name) to a public key; because you trust the CA's signature, you can trust the binding.

To get a cert you generate a keypair and a Certificate Signing Request (CSR) containing your public key and identity. A CA verifies you and signs it, returning a certificate. In TLS the server presents this cert plus any intermediates — the chain up to a trusted root.

During the TLS handshake the client validates that chain back to a root it already trusts, then both sides run an ephemeral key exchange (ECDHE) to derive fresh symmetric session keys. ECDHE gives forward secrecy: stealing the server's private key later cannot decrypt past traffic.

A CA signs certs that bind an identity to a public key.

A CSR requests a certificate for your keypair.

TLS validates the chain to a root, then derives session keys via ECDHE.

openssl req -newkey rsa:2048 -keyout key.pem -out csr.pem
openssl x509 -req -in csr.pem -signkey key.pem -out cert.pem
openssl s_client -connect host:443 -servername host
openssl verify -CAfile ca.pem cert.pem

Read the implementation

Connect each part of the code to the concept before you type.

1. Make key + CSR

req -newkey generates a private key and a Certificate Signing Request that asks a CA to certify your public key and identity.

openssl req -newkey rsa:2048 -keyout key.pem -out csr.pem

2. Sign a certificate

x509 -req -signkey signs the CSR — here self-signed, but a real CA signs with its own key to issue the cert.

openssl x509 -req -in csr.pem -signkey key.pem -out cert.pem

3. Inspect TLS handshake

s_client opens a TLS connection and prints the cert chain the server presents; -servername sends SNI.

openssl s_client -connect host:443 -servername host

4. Verify the chain

verify -CAfile checks that cert.pem chains up to a trusted root in ca.pem and is otherwise valid.

openssl verify -CAfile ca.pem cert.pem

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.