Lion Cipher Lab
Build a private certificate authority and issue TLS certificates with OpenSSL
- Cyber / Security Engineer
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Certificates feel like magic: a padlock appears, and somehow your browser is sure it is really talking to your bank. Most people — including working engineers — never see what is underneath, so 'just add a certificate' becomes a cargo-cult ritual of copied commands and clicked-through warnings. This lab demystifies it completely by making you build the whole thing from scratch with one tool. You create your own certificate authority, issue a real TLS certificate for a local service, serve it, and then watch the precise moment trust switches on: the same request that failed a second ago…
What you'll learn
- how a certificate authority, a certificate, and a private key actually relate
- generating a CA private key and a self-signed root certificate with openssl
- creating a certificate signing request (CSR)
- signing a CSR to issue a leaf certificate, with a subjectAltName (SAN) extension
- serving a local TLS service and verifying the chain with openssl verify and curl
- why a browser only trusts your certificate after you add your root CA
- guarding a CA private key and understanding the scope of the trust you create
Steps in this lab
- The vocabulary, defined once — CA, key, certificate, chain, CSR
- Set up a clean workspace and confirm openssl
- Create the CA: a private key and a self-signed root certificate
- Create the server's key and a certificate signing request (CSR)
- Sign the CSR to issue a leaf certificate — with a SAN extension
- Serve it over TLS and watch trust fail, then succeed
- Make a browser trust it — by adding YOUR root, not the leaf
- Clean up, guard the key, and where this goes next