World map

 

BM

World L3: Phone Lines

HTTPS and certificates

You will learn: what a certificate is, how to read its dates, and what its errors mean.

Checked with Linux (Debian 13) on 1 Nov 2026

The problem

laptop
curl -sS https://kedai.example
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.se/docs/sslcerts.html

Monday morning. Customers see a scary warning. The real error says certificate has expired. Plain words: the shop’s ID card ran out.

Watch

A certificate: A server's ID card: its names, who signed it and when it expires. is the server’s ID card: its name, who signed it, and its dates. curl -v shows it. Tap the end date.

Tap the line with the end date.

0 of 1 found

Watch

HTTPS: HTTP in a sealed envelope. The shop also shows an ID card: its certificate. is HTTP in a sealed envelope. A trusted office, the certificate authority, signs ID cards. Put the check in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • curl checks the signer, the name and the dates
  • curl says hello and asks for the ID card
  • The order travels sealed
  • Both agree on a secret key
  • The shop shows its certificate

Try it

kedai has no sealed line yet. Prove it: call https://localhost, then look at ss -tln.

You are hereyou@kedai:~$

Folder ~

Empty folder

+ 3 hidden (ls -a)

Services

  • cronrunningstarts at boot
  • sshrunningstarts at boot
  • nginxrunningstarts at boot

Phone lines (network) Address 10.0.0.5

Listening ports

  • :22 sshd
  • :80 nginx

Watch

laptop
openssl s_client -connect kedai.example:443 < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
subject=CN=kedai.example
issuer=CN=Kancil Practice CA
notBefore=Nov 1 12:47:46 2026 GMT
notAfter=Jan 30 12:47:46 2027 GMT
openssl s_client -connect kedai.example:443 < /dev/null 2>/dev/null | openssl x509 -noout -checkend 2592000
Certificate will not expire

openssl s_client fetches the ID card like a browser. x509 reads it. -checkend 2592000 asks: still good in 30 days?

Predict

curl https://203.0.113.10 says no alternative certificate subject name matches. Why?

Check

Real errors, plain fixes. Sort them.

Drag a card into a box. Or tap the card, then tap the box.

        You did it!

        You can now read a certificate’s dates and name its errors.

        Go deeper (optional)

        These outputs came from our own practice lab. It has a home-made CA, so we told the laptop to trust it. Real shops get free certificates from Let’s Encrypt and renew them automatically. curl -k skips every check: use it only to look, never in scripts.

        Real mission

        1. openssl s_client -connect example.com:443 < /dev/null 2>/dev/null | openssl x509 -noout -dates
        2. curl -sv -o /dev/null https://example.com

        0 of 2 steps done · Your ticks are saved.