TLS certificates: chains, trust and what breaks them

The idea

A certificate says who a server is and who vouches for it. Read TLS certificates, then see what breaks them: the laptop visits four web servers across officeRouter (shop, blog, forum and staging) and the office printer.

Steps

1. What a certificate says, and who signed it

   Encryption alone is not enough: you must also know you reached the real shop, not someone posing as it. https:// is HTTP inside TLS, and the server starts by showing a certificate. Fetch shop's page with -v and read what its certificate says.

   laptop:~# curl -sv https://shop.lab/

2. SNI and ALPN: what the hello says

   TLS starts with a hello from the client, before anything is encrypted, because the two sides must agree how to encrypt first. Fetch shop's page again while officeRouter prints the bytes passing on Port 443.

   laptop:~# curl -sv https://shop.lab/