The padlock that vanished at midnight
A shop's web site shows a big red warning to every customer. Sales stop. Cause: a certificate ran out at midnight. Nobody noticed.
A big company holds thousands of certificates. Nobody can keep track in a notebook. Today you meet the tools that do.
Key words
| Word | What it means |
|---|---|
| Certificate management tool | Software that keeps track of certificates and looks after them. |
| Digital certificate | An electronic passport that proves who a device, server or user is. |
| Expiry date | The date after which a certificate is no longer valid. |
| Revoke | Cancel a certificate before its expiry date. |
| Renewal | Replacing a certificate with a new one before the old one runs out. |
| Issue | Make a certificate and hand it to its holder. |
| Deploy | Put a certificate in place where it is used. |
| Audit | A check that shows what is in place and what is not. |
| Diagnosis | Finding the cause of a fault. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can explain what certificate management tools do: watch expiry, revoke, renew, create, sign and issue, audit and diagnose.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Monitoring, revoking and renewing
A management tool monitors expiry dates. It warns well before a certificate runs out.
It can revoke a certificate early, for example if the private key is stolen. A revoked certificate must no longer be trusted.
It can also renew certificates by itself, before they run out.
Extra: Check when a certificate ends
cd ~/certlab && openssl x509 -in demo.crt -noout -enddate -checkend 86400; echo "exit code $?"A command for the lesson’s lab terminal. It is shown here and not run.
Extra: Will it end in 30 days?
cd ~/certlab && openssl x509 -in demo.crt -noout -checkend 2592000; echo "exit code $?"A command for the lesson’s lab terminal. It is shown here and not run.
Read the two answers
The first run prints the end date, then Certificate will not expire and exit code 0. The second run prints Certificate will expire and exit code 1.
The test certificate was made for 20 days. So it lasts for one more day, but not 30. A tool does this check for every certificate, every day, and warns a person.
Check: watching the clock
Have a go
Check: watching the clock
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.