Unit 5: HTTPS and certificates · Lesson 4 of 5 · 22 min

Project: audit the certificate inventory

Find the certificates that have expired or are about to, before customers do.

mission

You are
The analyst on the shop's platform team.
Situation
Last year a certificate expired on a Saturday and took the API down. Today is 14 October 2026, and ops exported every certificate the company runs into certs/inventory.
Goal
List each certificate's names and expiry date and flag what needs action this month.
Hand in
A short table: certificate, names, expires, action.

A certificate inventory check

  1. ListEvery certificate you run
  2. ExpiryFlag anything within 60 days
  3. NamesCheck each covers what it serves
  4. OwnerSomeone renews it
01

See what you have

learner@web-lab
ls certs/inventory
api.crt
legacy.crt
mail.crt
status.crt

you should see Four certificates.

02

Expiry dates

learner@web-lab
for f in certs/inventory/*.crt; do printf '%-12s ' $(basename $f); openssl x509 -in $f -noout -enddate; done
api.crt      notAfter=Nov  5 00:00:00 2026 GMT
legacy.crt   notAfter=Sep 30 00:00:00 2026 GMT
mail.crt     notAfter=Jan  1 00:00:00 2029 GMT
status.crt   notAfter=Sep  1 00:00:00 2027 GMT

you should see One date already passed, one falls within the next month.

03

Names on each

learner@web-lab
for f in certs/inventory/*.crt; do echo "== $(basename $f)"; openssl x509 -in $f -noout -ext subjectAltName | tail -n 1; done
== api.crt
    DNS:api.shop.internal
== legacy.crt
    DNS:legacy.shop.internal
== mail.crt
    DNS:*.shop.internal
== status.crt
    DNS:status.shop.internal, DNS:status.example.com

you should see One certificate is a wildcard that covers every name under shop.internal.

defender tip Wildcards are convenient but spread risk: one leaked key works for every host it covers. Keep them off machines that do not need them.

04

Check one against a date

-checkend takes seconds from now. Monitoring tools run it every day.

learner@web-lab
openssl x509 -in certs/inventory/legacy.crt -noout -checkend 0
Certificate will expire

you should see It has already expired.

What a defender takes away

  1. 1Keep an inventory of every certificate and check expiry automatically.
  2. 2Renew at least 30 days before expiry; certificates now live a year or less.
  3. 3Treat wildcard certificates as high value keys.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.