Advanced › Module 6 › Lesson 4
Lab — PKI
PKI literacy lab on $CRYPTO_LAB — lifecycle card, CT row, OCSP read via openssl against lab CA or example.com.
Visual · t28_pki_lab
Lab: PKI literacy pack on YOUR $CRYPTO_LAB or example.com read. Original Cyberlium.
Opening
Ship PKI literacy artifacts from YOUR lab CA or example.com chain read — zero prod MITM or forged CA work.
On YOUR $CRYPTO_LAB per brief: (1) scope proof — lab CA name or example.com public read labeled; (2) cert lifecycle card five stages with checkpoints; (3) CT literacy row — one crt.sh or log concept applied to brief domain; (4) OCSP/CRL comparison plus one openssl s_client -connect example.com:443 -servername example.com -status snippet (read-only); (5) chain field table — subject, issuer, SAN, validity, sig alg from saved output; (6) integrity block — $CRYPTO_LAB only, no forged CA, no prod attacks; (7) chmod 600 pack. Use instructor lab CA files or public example.com — NOT stranger domain issuance, NOT MITM banking TLS.
1. Lab deliverables
Lifecycle + CT + OCSP rows cross-indexed to one chain source (lab CA or example.com).
Saved openssl output redacted in share-safe copy; full paths chmod 600 mentor pack.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Certificate Transparency — https://certificate.transparency.dev/how-it-works/ crt.sh — https://crt.sh/ RFC 5246 — https://www.rfc-editor.org/rfc/rfc5246 (TLS 1.2 literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl sudo apt install curl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
openssl verify -CAfile "$CRYPTO_LAB/certs/lab-selfsigned.crt" "$CRYPTO_LAB/certs/lab-selfsigned.crt" 2>&1 | head -3
curl -sS https://certificate.transparency.dev/how-it-works/ | head -10
curl -sS https://www.rfc-editor.org/rfc/rfc5246 | head -8═══ WINDOWS ═══
Command — copy this
openssl x509 -in $HOME/cyberlium-lab/t28-crypto/certs/lab-selfsigned.crt -noout -subject curl -sS https://certificate.transparency.dev/ | Select-Object -First 8
Primary tools to practice this lesson: openssl, curl. Reference sites: Certificate Transparency (https://certificate.transparency.dev/how-it-works/); crt.sh (https://crt.sh/); RFC 5246 (https://www.rfc-editor.org/rfc/rfc5246). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Label public read vs $CRYPTO_LAB CA artifact — separate evidence classes.
No private keys from unauthorized sources in pack.
3. Teardown
Secure notes chmod 600; delete temp key material if brief generated test keys.
No lab CA cert installed in system trust store without brief approval.
4. What you ship: PKI lab pack
Lifecycle + CT + OCSP + chain table + integrity — chmod 600.
5. What you record before the next lesson
PKI lab pack path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
PKI lab includes forged CA cert for stranger domain MITM.
Right
PKI lab pack on $CRYPTO_LAB or example.com read. Next: quiz.
Mission: PKI lab
1) Scope and source proof. 2) Lifecycle and CT rows. 3) OCSP read snippet from example.com or lab. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “example.com read — minimum openssl flags?”
Knowledge Check
APPLY: PKI lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Forged CA belongs in PKI lab pack.
True or False
Knowledge Check
APPLY: openssl s_client against example.com is:
Multiple choice