Quiz — TLS/HTTPS
10-question quiz on TLS, certificates, and certificate authorities
TLS & HTTPS — module APPLY check
You followed TLS from ClientHello to encrypted application data, read certificate fields the browser actually checks, treated CAs as vouchers (and extra roots as a MITM gift), and inspected a public leaf on example.com or a domain you own. HTTPS is HTTP inside TLS: the path and body are ciphertext to a passive observer; the padlock is name binding plus encryption, not a honesty medal. Phishing sites can still obtain valid certificates for their own names. Certificate Transparency is a conceptual public log, not a weapon. Ten APPLY items covering handshake beats (ClientHello, cert, conceptual TLS 1.3 key agreement, encrypted app data), SAN/issuer/dates, CA vouching and CT as a glass log, and the cert lab on example.com or a domain you own. No fake CAs. No intercepting others. No sslstrip. No live private keys in notes. Reward badge: +40 XP — TLS & HTTPS Complete! Proceed: Continue to Crypto in Practice. Next lesson title: Common Crypto Mistakes — homebrew, nonce reuse, and rolling your own protocols, taught so you AVOID them, not so you attack someone with a broken cipher. Lab files stay in $HOME/cyberlium-lab at chmod 600.
APPLY: A café login page shows a padlock. A classmate says HTTPS is “hashing over SMTP” and that you should stand up a fake CA to watch the handshake. What is HTTPS, and what did the handshake finish?
APPLY: True or False: The TLS handshake typically includes the server certificate, and after Finished, bulk HTTP is protected with symmetric session keys — which means you may sslstrip a neighbor to “verify their cipher.”
APPLY: You typed www.example.com. Which certificate field family decides whether that name is covered, and what is not a field?
APPLY: Why does a browser trust a leaf for example.com? A PDF wants you to install an extra root so a portal loads.
APPLY: Select the TLS benefits this module actually taught. (Select 2)
APPLY: openssl x509 -noout -dates on a public leaf shows last month as notAfter. The site is a bank login. Correct client behavior?
APPLY: True or False: A phishing site can obtain a valid certificate for its own domain name, so a padlock on paypa1-secure.example is not proof you reached PayPal.
APPLY: In the cert lab you ran openssl s_client -connect example.com:443 -servername example.com. What is that for, and what is it not?
APPLY: A domain you operate shows a certificate in a public log that you did not request. What is Certificate Transparency for, conceptually, and what do you not do?
APPLY: The next module is Common Crypto Mistakes, then key management and an encrypt/verify lab. A name-mismatch interstitial appears on a site asking for your password. Best habit, and which gray zone stays closed?