Interactive PKI Demos

Learn symmetric vs asymmetric encryption fundamentals. Interactive demo shows AES, RSA, and why TLS uses both.

Type a message and watch RSA encrypt and decrypt it step by step. See modular exponentiation, key generation, and the square-and-multiply algorithm in action.

Compare RSA and ECC for certificates. Understand key sizes, performance, and when to choose each algorithm.

Visualize Diffie-Hellman and ECDHE key exchange. See how two parties derive a shared secret securely.

Big-picture overview of how TLS secures web traffic. See the handshake, key exchange, and encrypted data flow.

Explore SHA-256, SHA-384, and why MD5/SHA-1 are deprecated. See collision resistance demonstrated.

Visualize the CA trust chain from root to intermediate to end-entity certificates. See how PKI hierarchy establishes trust.

Decode cipher suite strings like TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384. Understand key exchange, encryption, and MAC.

Compare TLS 1.0, 1.1, 1.2, and 1.3. Understand security improvements and migration requirements.

Learn how PFS protects past sessions even if the server's private key is compromised. See ECDHE in action.

Visualize how digital signatures provide authenticity and integrity using hash functions and asymmetric keys.

See how code signing certificates verify software authenticity and integrity. Interactive signing and verification demo.

Step through the TLS 1.2 and 1.3 handshake message by message. See ClientHello, ServerHello, and more.

See how S/MIME certificates enable encrypted and signed email. Understand the difference from PGP.

Understand when self-signed certificates are appropriate and their security implications.

Compare Domain, Organization, and Extended Validation certificates. Understand validation requirements and use cases.

Explore X.509 certificate fields interactively. Understand subject, issuer, validity, extensions, SANs, and key usage.

Walk through the complete certificate lifecycle from key generation to CSR, issuance, deployment, monitoring, and renewal.

Understand certificate formats: PEM, DER, PFX/P12, JKS. Learn when to use each and how to convert between them.

Learn PKCS#12/PFX format for bundling certificates with private keys. Create, extract, and convert PFX files.

Build a Certificate Signing Request step-by-step. Understand each CSR field and generate OpenSSL commands.

Learn how ACME protocol automates certificate issuance with Let's Encrypt. Interactive demo shows the challenge-response flow and DNS/HTTP validation.

Explore how browsers and OSes decide which CAs to trust. Compare Chrome, Mozilla, Apple, and Microsoft policies.

Explore SSH certificate structure interactively. Understand principals, validity, extensions, and how SSH certificates differ from X.509.

Paste any SSL/TLS error message and get plain English explanations with fixes. Covers Chrome, Firefox, Java, and OpenSSL errors.

Master SANs for multi-domain certificates. See SAN types: DNS, IP, email, and URI with real examples.

Debug certificate name mismatch errors. Understand CN vs SAN, wildcard scope, and common mistakes.

Understand wildcard certificate security risks. Learn scope limitations and safer alternatives.

Debug certificate chain issues interactively. Paste your certs to visualize the chain and find missing intermediates.

Deep dive into certificate revocation: CRL, OCSP, OCSP Stapling, and why browsers handle revocation checking differently.

Learn how HSTS forces HTTPS connections. Understand preload lists and common HSTS configuration pitfalls.

Troubleshoot common Let's Encrypt and Certbot errors. Fix HTTP-01 and DNS-01 challenge failures.

Explore common PKI failures: expired certs, revoked certs, chain issues, name mismatch, and MITM attacks.

Compare certificate revocation methods: CRL, OCSP, and OCSP Stapling. Understand tradeoffs and browser behavior.

Diagnose SSL/TLS connection problems systematically. Interactive troubleshooter for common issues.

Understand CAA DNS records and how they control which CAs can issue certificates for your domain. Interactive demo with examples.

Explore CT logs and how they detect mis-issued certificates. See how SCTs work and why CT matters for security.

Learn Simple Certificate Enrollment Protocol for automated device certificate provisioning.

Understand HSMs for protecting private keys. See how HSMs prevent key extraction even if servers are compromised.

Understand the critical difference between crypto agility and certificate agility. Learn why you need both to survive CA distrust events and the post-quantum transition.

Compare cloud PKI options: AWS ACM, Azure Key Vault, GCP Certificate Authority Service, and HashiCorp Vault.

Understand mutual TLS where both client and server authenticate with certificates. See the two-way handshake.

Learn how certificate pinning works, why it breaks apps after cert rotation, and modern alternatives like Certificate Transparency.

See how cert-manager automates certificate lifecycle in Kubernetes. Covers Issuers, ClusterIssuers, and Certificate resources.

Walk through a simulated enterprise signing request: developer asks, an approver authorizes, the HSM signs, and a tamper-evident audit log records every step. Mirrors the Venafi CodeSign Protect / CyberArk Code Sign Manager workflow.

Convert between PEM, DER, and PKCS#12 formats using OpenSSL. Step-by-step commands for certificate format conversion.

Generate RSA and ECC private keys with OpenSSL. Learn proper key sizes and security parameters for certificates.

Inspect certificates with OpenSSL commands. View subject, issuer, validity, SANs, and extensions from the command line.

Create Certificate Signing Requests with OpenSSL. Generate CSRs with SANs using config files and command line.

Understand Java KeyStore format and structure. Learn JKS basics for managing certificates in Java applications.

Learn the difference between Java keystore and truststore. Fix PKIX path building failed errors and configure SSL.

Essential keytool commands for managing Java keystores. Import, export, list, and delete certificates and keys.

Convert certificates between JKS, PKCS#12, and PEM formats. Step-by-step keytool and OpenSSL commands.

Fix Java SSL errors: PKIX path building failed, certificate exceptions, and truststore configuration issues.