Web stack / Stage 4 of 9

Trust, name and expiry of a certificate

Not running Starting usually ~20 s

Step 8 of 8 · summary · 2 min

Summary

curl checks the certificate before HTTP: the issuer is in the trust store, the name from the address is in the SAN, the current time is between notBefore and notAfter. If any check fails — code 60 and the reason in the error text.
openssl s_client … | openssl x509 -noout … shows the certificate a server serves, and openssl x509 -in shows a certificate in a file.
A new certificate is issued from a CSR made with the existing key: the CA adds its signature and a new validity period, and -copy_extensions copy carries the SAN over.
secure.lab.test from the start of the lesson: nginx was running, but curl closed the connection because the certificate's notAfter was three days in the past.

Ubuntu 24.04