Lion Cipher Lab
Inspect a TLS connection and certificate with openssl s_client
- Cyber / Security Engineer
- Beginner
- ~40 min
- Free · no account required
Why it matters
A browser padlock is a single icon standing in for four separate facts: the connection is encrypted, it is encrypted to a specific hostname, a certificate authority vouched for that identity, and the certificate has not expired. openssl lets you open the connection yourself and read every one of those facts from the raw bytes — the same bytes the browser checks silently on every HTTPS page load, and more detail than any padlock will ever show you. That is a foundational defensive skill: triaging a certificate warning, confirming your own site's certificate is valid and not about to expire,…
What you'll learn
- opening a live TLS connection with openssl s_client -connect
- reading the certificate chain a server presents
- extracting and decoding a certificate with openssl x509 (subject, issuer, SAN, validity dates)
- reading the negotiated TLS protocol version and cipher
- verifying hostname coverage and checking a certificate for expiry
- recognizing self-signed, expired, name-mismatch, and weak-protocol problems from the command line
Steps in this lab
- What TLS and a certificate are — and the ground rules
- Install openssl and confirm it runs
- Open a real TLS connection and read the chain
- Extract and decode the certificate with x509
- Verify hostname coverage and check for expiry
- Read the negotiated protocol and cipher
- Spot the problems on purpose with badssl.com
- What you just learned — and the honest limit