Type to search…
Skip to content

Certificado

Deploy an HTTPS server by signing the same certificate three times - self-signed, with your own authority, and with Let's Encrypt.

Taught in
Desplegament d’aplicacions webDesplegament al núvolDAWDAW-BIOSeguretat i alta disponibilitatAccés remotASIX

Introduction

In Transport Layer Security you learned that TLS does two things: it encrypts the connection and authenticates the server.

Authentication is done by a certificate: a digital document that says this public key belongs to xtec.dev.

But a document is only as good as whoever signs it.

In this activity you’ll sign the same certificate three times, and each time the browser will tell you something different:

Who signs itWhat the browser says
The server itselfSEC_ERROR_SELF_SIGNED_CERT
An authority you’ve created yourselfSEC_ERROR_UNKNOWN_ISSUER
Let’s Encrypt🔒

The encryption is identical in all three cases.

What changes is the trust.

Work environment

You need a machine with a public IP and a domain name, because Let’s Encrypt needs to be able to connect to it from the Internet to check that the domain is yours.

Create an Ubuntu virtual machine in Virtual Machine.

Connect via ssh and install nginx:

shell
sudo apt update
sudo apt install -y nginx

Open the browser at the machine’s public IP.

You now have a web server accessible to everyone on port 80, over a connection that is not encrypted.

This is HTTP.

Look at what travels over the network

From your computer, request the home page with curl in verbose mode.

Mostra la solució
shell
curl -v http://20.86.14.7/
* Connected to 20.86.14.7 (20.86.14.7) port 80
> GET / HTTP/1.1
> Host: 20.86.14.7
>
< HTTP/1.1 200 OK
< Server: nginx/1.24.0 (Ubuntu)
< Content-Type: text/html
<
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>

The request, the headers and the document travel in plain text.

Anyone in the middle of the path can read it.

DNS

A certificate doesn’t authenticate an IP: it authenticates a name.

Register a free subdomain at No-IP and point it to your machine’s public IP:

From now on your machine has a name, for example xtec.hopto.org:

shell
curl -sI http://xtec.hopto.org | head -n 1
HTTP/1.1 200 OK

Keep reading — it's free.

The rest of this page is open to anyone with a free account. Nothing is sold here and nothing is charged for: the account exists so we know who agreed to the terms, and so we can send you the newsletter if you want it.

Create a free account

You will be asked to accept the Terms · Privacy Policy