Is this really my bank?
You type a web address. A page appears with the right name and logo. But anyone can copy a logo. How does your browser know it is the real bank and not a copy?
It asks for a digital passport. Today you learn what is inside one.
Key words
| Word | What it means |
|---|---|
| Digital certificate | An electronic passport. It proves who a device, server or person is. |
| Certificate holder | The company, server or device that the certificate was issued to. |
| Serial number | A number given to one certificate only. |
| Expiry date | The date after which a certificate is no longer valid. |
| Public key | The key you share with everyone. |
| Issuer | The authority that made and signed the certificate. |
| Certificate authority | A trusted body that issues certificates. Short form: CA. |
| Server side certificate | Lets a client check a server is real. |
| Client side certificate | Lets a client prove who it is to a server. |
| Code signing certificate | Lets an OS check who wrote software and that it was not changed. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can say what a digital certificate is for, name its five features and describe the three types.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
The purpose of a certificate
A digital certificate is an electronic signature. It proves that a device, a server or a user is who they say they are.
It does this with asymmetric cryptography. The certificate holds the holder's public key. A trusted body has signed it. If you trust the body, you can trust the key.
The five features
Every certificate holds five things.
- The name of the holder: a company, a server or a device.
- A unique serial number.
- An expiry date.
- The holder's public key.
- The issuer's signature, which shows which authority made it.
Extra: Make a small test certificate and key
mkdir -p ~/certlab && cd ~/certlab && openssl genrsa -out demo.key 2048 && openssl req -x509 -new -key demo.key -out demo.crt -days 20 -subj "/C=GB/O=Demo Shop/CN=shop.example.test"A command for the lesson’s lab terminal. It is shown here and not run.
Extra: Look inside the certificate
cd ~/certlab && openssl x509 -in demo.crt -noout -subject -issuer -serial -datesA command for the lesson’s lab terminal. It is shown here and not run.
Read the output
The lines show the subject (the holder: the shop name), the issuer, the serial number and the dates. This test certificate is self-signed, so the issuer is the same as the holder. A browser would not trust it.
The holder, the serial number and the expiry date are on show. The public key and the signature are inside the file too.