Inspect a website's certificate chain

Environment

Any web browser (click the padlock → certificate details). Optionally openssl in a terminal.

Before you start

• Read Digital Certificates, Root of Trust, Subject Name Attributes and Certificate Revocation (p.59–64).

You will

• Find the SAN entries and the issuer
• Trace the chain from the site to a root CA
• Find where the CRL or OCSP information is published

Steps

1. 1

   Open a well-known HTTPS site, click the padlock and open the certificate viewer.

2. 2

   Note the Subject and the Subject Alternative Names. Are there several names or a wildcard such as *.example.com?

3. 3

   Note the validity dates and the public key algorithm and size (RSA 2048 or ECC 256).

4. 4

   Open the certificate hierarchy and list each certificate from the site up to the root, noting which are intermediates.

5. 5

   Find the 'CRL Distribution Points' and 'Authority Information Access' (OCSP) fields.

6. 6

   Optional: run openssl s_client -connect example.com:443 -servername example.com -showcerts and match the output with what the browser showed. Type Q and press Enter to quit.

Check your understanding

• ?Why do browsers check the SAN instead of the Common Name?
• ?Why does the site's certificate chain up through an intermediate rather than straight to the root?
• ?What's the difference between checking a CRL and asking an OCSP responder?