SSL Certificates

<aside> 🔐

SSL Certificates — from first principles to interview-ready

A complete, self-contained learning track in 14 modules. No prior cryptography or SSL knowledge assumed — only that you are comfortable on a Linux command line.

Every topic builds only on what came before it. Every concept carries a runnable exercise with the expected output hidden behind a toggle, and every topic closes with real interview questions whose answers are hidden until you click.

</aside>

<aside> 🛡️

Before you start — running these exercises safely, especially on a work laptop.

Almost everything in this track is completely self-contained. Every exercise writes only into ~/tls-lab/, uses only openssl, and touches nothing else. You can delete ~/tls-lab at the end and your machine is exactly as it was.

Three things are the exception, and each is clearly marked where it appears:

What	Where	Safe alternative
Installing a CA into the system trust store	Module 05, A3.2	Use `-CAfile` / `--cacert` instead — it proves the same point and changes nothing
Binding a local port with `openssl s_server`	Modules 04, 06, 07	Harmless, but use a high port (4433+) and stop it afterwards
Editing `/etc/hosts`	never required	Use `curl --resolve` instead, which is used throughout

If you are on a managed or corporate laptop, do not install a CA into the system trust store. Endpoint security and MDM compliance tooling frequently monitor the System keychain, and adding a root can raise an alert or a compliance failure even though the certificate is harmless. The -CAfile approach teaches the identical lesson.

To clean up everything, at any point:

pgrep -f 'openssl s_server' | xargs -r kill    # stop any test servers
rm -rf ~/tls-lab                               # remove every file this track created

</aside>