Unit 5: HTTPS and certificates · Lesson 2 of 5 · 18 min
Reading certificates
Who the certificate is for, who signed it and which names it covers.
mission
- You are
- The analyst reviewing the shop's HTTPS site.
- Situation
- A developer wants to add a new hostname to the shop and asks whether the current certificate already covers it.
- Goal
- Read the subject, issuer, names and allowed uses of the live certificate.
- Hand in
- The list of names the certificate is valid for.
A certificate, taken apart
Grab the certificate
Save what the server sends so you can read it without reconnecting.
openssl s_client -connect shop.internal:8443 </dev/null 2>/dev/null | openssl x509 > shop.pem && head -n 1 shop.pem
-----BEGIN CERTIFICATE-----
you should see The PEM header line. The file holds the server's certificate.
Who it is for, who signed it
openssl x509 -in shop.pem -noout -subject -issuer
subject=C = GB, O = Example Shop, CN = shop.internal
issuer=C = GB, O = Example Shop, CN = Example Shop Internal CA
you should see The shop's name as subject, the internal CA as issuer.
Every name it covers
openssl x509 -in shop.pem -noout -ext subjectAltName
X509v3 Subject Alternative Name:
DNS:shop.internal, DNS:www.shop.internal
you should see Browsers ignore the CN today. Only these names count.
What it may be used for
openssl x509 -in shop.pem -noout -ext basicConstraints,extendedKeyUsage
X509v3 Basic Constraints:
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Server Authentication
you should see Not a CA, and only for TLS servers.
defender tip A leaf certificate with CA:TRUE could sign certificates for any name. Always check basicConstraints on certificates you did not issue yourself.
What a defender takes away
- 1The subject alternative names decide which hostnames a certificate covers.
- 2The issuer is the authority you have to trust.
- 3Check basicConstraints and key usage, not just names and dates.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.