Lab — Analyze SSL Certificate

openssl s_client -connect HOST:443 -servername HOST opens TCP 443 and runs TLS, sending SNI so virtual hosts present the correct certificate. The PEM between BEGIN CERTIFICATE and END CERTIFICATE is the leaf (s_client may also show the chain). Piping to openssl x509 -noout -subject -issuer -dates -ext subjectAltName prints the fields you already named. curl -vI --connect-timeout 10 https://HOST asks for headers over TLS; verbose mode shows the handshake at a high level and the HTTP status. Neither command decrypts other people’s sessions. Neither command plants a CA. On Windows, use Git Bash or WSL if openssl and curl are not in PowerShell. If s_client waits after the PEM, end the client (Ctrl+C) or feed it a closed stdin (echo | …) as in the script. -servername is not optional on modern multi-site hosts: without SNI you may get a default cert that does not match the name you intended — a useful lesson, not a reason to skip SNI. Write the name you typed, then the SAN list, then yes/no match.

cert-lab.txt is evidence of YOUR read: subject, issuer, notBefore, notAfter, SAN, protocol if you saw it, and the ethics line. It is not a password file, not a cookie jar, not a private key. chmod 600 anyway because the folder will hold lab passphrases in the next module. Empty notes fail. Notes that include a classmate’s captured traffic fail ethics even if openssl ran. Challenge (optional): repeat on a domain you own and compare issuer and validity period with example.com — still public certs, still your notes, still no MITM.

example.com is explicitly in this lab’s contract. A hostname whose DNS you control is in contract. A bank you do not operate, a school VPN appliance you saw on a sticker, and a neighbor’s router admin page are not “more realistic labs.” Visiting a public website in a browser is ordinary. Silently intercepting that visit for someone else is not. Installing the PEM you saved as a trusted root is the CA lesson’s failure mode — do not undo it here because “the lab wanted a file.” The file is cert-lab.txt, mode 600, text fields, your words.

Create the lab directory. Run the dump. Fill every placeholder in cert-lab.txt in your own handwriting-in-a-file — do not submit an empty template. Then chmod 600. If openssl is missing, install it from a vendor you trust or use WSL; do not “substitute” a TLS-intercepting app store VPN.

mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"
HOST="example.com"   # or a domain YOU own

echo | openssl s_client -connect "${HOST}:443" -servername "$HOST" 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

echo | openssl s_client -connect "${HOST}:443" -servername "$HOST" 2>/dev/null \
  | openssl x509 -outform PEM > "$HOME/cyberlium-lab/cert-lab-leaf.pem"

curl -vI --connect-timeout 10 "https://${HOST}" 2>&1 | head -n 40

curl.exe -vI --connect-timeout 10 https://example.com

NOTES="$HOME/cyberlium-lab/cert-lab.txt"
{
  echo "=== SSL CERTIFICATE LAB ==="
  echo "target: example.com OR a domain I own (public cert read)"
  echo "host_typed:"
  echo "subject:"
  echo "issuer:"
  echo "notBefore:"
  echo "notAfter:"
  echo "SAN:"
  echo "name_match: yes/no"
  echo "curl_https: (status / TLS observed — not cookies, not passwords)"
  echo "ethics: public cert only; no MITM; no fake CA; no intercepting others; no private keys"
} > "$NOTES"

chmod 600 "$NOTES" "$HOME/cyberlium-lab/cert-lab-leaf.pem" 2>/dev/null || chmod 600 "$NOTES"

You fetched a public leaf the way a client does, wrote the fields an analyst actually records, and locked the file. Matching SAN to the name you typed is the handshake’s name-binding check in slow motion. Next — Quiz — TLS/HTTPS — ten APPLY items on the handshake, certificates, CAs, and this lab. Then Common Crypto Mistakes in Module 4. Still no homebrew attacks, still no MITM.