Lion Cipher Lab
Inspect a website's TLS certificate
- AppSec / DevSecOps
- Beginner
- ~30 min
- Free · no account required
Why it matters
Every HTTPS page load already downloads and checks a TLS certificate before you see a single pixel, then boils the whole result down to one padlock icon. That padlock is doing two jobs at once, and most people only know about one of them: it means the connection is encrypted, and it means the site proved its identity to a certificate authority your browser trusts. Being able to open that certificate yourself and read who it is for, who issued it, when it expires, and whether it chains to a trusted root turns the padlock from a mystery symbol into something you can verify. It is a foundational…
What you'll learn
- reading a TLS/SSL certificate with openssl s_client
- identifying the subject and Subject Alternative Names (who a cert is for)
- identifying the issuer and the chain to a trusted root (which CA)
- reading a certificate's validity dates and spotting expiry
- cross-checking a cert with curl -vI
- recognizing expired, self-signed, and name-mismatch warnings
Steps in this lab
- What a TLS certificate is — and the ground rules
- What the padlock actually means
- Take your first look with openssl s_client
- Read the subject and SAN — who the certificate is for
- Read the issuer and the chain — which CA vouched for it
- Read the validity dates — is it current or expired?
- Cross-check with curl — and see real warnings on purpose
- What you just learned — and where it goes next