SSL Certificates

Updated 28 August 2026

SSL Certificates — from first principles to interview-ready

A complete, self-contained learning track in 14 modules. No prior cryptography or SSL knowledge assumed — only that you are comfortable on a Linux command line.

Every topic builds only on what came before it. Every concept carries a runnable exercise with the expected output hidden behind a toggle, and every topic closes with real interview questions whose answers are hidden until you click.

Before you start — running these exercises safely, especially on a work laptop.

Almost everything in this track is completely self-contained. Every exercise writes only into ~/tls-lab/, uses only openssl, and touches nothing else. You can delete ~/tls-lab at the end and your machine is exactly as it was.

Three things are the exception, and each is clearly marked where it appears:

What	Where	Safe alternative
Installing a CA into the system trust store	Module 05, A3.2	Use -CAfile / --cacert instead — it proves the same point and changes nothing
Binding a local port with openssl s_server	Modules 04, 06, 07	Harmless, but use a high port (4433+) and stop it afterwards
Editing /etc/hosts	never required	Use curl --resolve instead, which is used throughout

If you are on a managed or corporate laptop, do not install a CA into the system trust store. Endpoint security and MDM compliance tooling frequently monitor the System keychain, and adding a root can raise an alert or a compliance failure even though the certificate is harmless. The -CAfile approach teaches the identical lesson.

To clean up everything, at any point:

bash

pgrep -f 'openssl s_server' | xargs -r kill    # stop any test servers
rm -rf ~/tls-lab                               # remove every file this track created

🗺️ The track

🟢 Foundation

01 · Why TLS Exists — Crypto Primitives & Your Lab
02 · Keys, Encodings & File Formats
03 · Inside an X.509 Certificate
04 · CSRs & Self-Signed Certificates

🟡 Intermediate

05 · Chain of Trust & Running Your Own CA
06 · The TLS Handshake — 1.2 vs 1.3
07 · Certificate Validation
08 · Deploying TLS — NGINX & Apache
09 · Revocation — CRL, OCSP & Stapling
10 · ACME & Let's Encrypt

🔴 Advanced

11 · Certificate Transparency & CAA
12 · mTLS & Internal PKI
13 · Troubleshooting TLS at Scale
14 · Full Interview Simulation

📖 Modules

Module 01 — Why TLS Exists: Crypto Primitives & Your Lab Module 02 — Keys, Encodings & File Formats Module 03 — Inside an X.509 Certificate Module 04 — CSRs & Self-Signed Certificates Module 05 — Chain of Trust & Running Your Own CA Module 06 — The TLS Handshake, 1.2 vs 1.3 Module 07 — Certificate Validation: What a Client Actually Checks Module 08 — Deploying TLS: NGINX, Apache & the Chain-Order Trap Module 09 — Revocation: CRL, OCSP & Why It's Broken Module 10 — ACME & Let's Encrypt: Automation Is Now Mandatory Module 11 — Certificate Transparency, CAA & the Public Trust Ecosystem Module 12 — mTLS & Internal PKI Module 13 — Troubleshooting & Operating TLS at Scale

Module 14 — Full Interview Simulation

⌨️ Reference

⌨️ Daily Life Commands — the SSL cheat sheet

How to use this — read the concept, attempt the 🧪 exercise before opening the ✅ expected-result toggle, then close each topic by answering the 🎯 interview questions out loud without opening the answers.

When you have finished all fourteen, keep the ⌨️ Daily Life Commands page open instead — it is the working reference the track distils down to.

Spotted a mistake or want something added? Send me a note.

🔐SSL Certificates