Cyber Security Academy · Lesson

Certificate Validation

Verify server identity.

Certificate Validation is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Validate Certificates?

Encryption alone is not enough. If you encrypt a connection to an attacker, you have secured the wrong conversation.

Certificate validation ensures you are really talking to the intended server.

What the Client Checks

During the handshake the client verifies several things:

The certificate chain reaches a trusted root.
The certificate is within its validity period.
The certificate is not revoked.
The hostname matches.

Hostname Matching

The hostname you connected to must match the certificate's Subject Alternative Name (SAN) entries.

The old Common Name (CN) field is deprecated for this; modern clients require SAN.

openssl x509 -in cert.pem -noout -ext subjectAltName

Validity Dates

Every certificate has Not Before and Not After timestamps. Outside this window the certificate is rejected.

openssl x509 -in cert.pem -noout -dates

Trust Chain Verification

The client walks the chain from leaf to a root in its trust store, verifying each signature.

If no path to a trusted root exists, validation fails even if the certificate looks correct.

Revocation Checking

The client checks whether the certificate was revoked early using OCSP or a CRL.

Many browsers rely on OCSP stapling or curated revocation lists to keep checks fast.

Key Usage Constraints

Certificates declare allowed uses in Key Usage and Extended Key Usage extensions.

A server certificate must include serverAuth; a CA certificate must have the CA flag set. Misused certificates are rejected.

Certificate Pinning

Pinning hardcodes the expected certificate or public key in the client (common in mobile apps).

Even a valid, CA-signed but unexpected certificate is rejected, defending against rogue or compromised CAs.

When Validation Fails

Common validation errors include:

NET::ERR_CERT_DATE_INVALID (expired)
NET::ERR_CERT_COMMON_NAME_INVALID (hostname mismatch)
NET::ERR_CERT_AUTHORITY_INVALID (untrusted issuer)

The Danger of Skipping Validation

Disabling certificate verification (for example, curl -k or verify=False) removes all protection against impersonation.

This should never be used in production code, as it invites man-in-the-middle attacks.

# DO NOT do this in production
curl -k https://example.com

Verifying From the Command Line

You can run a full validation check against a live server.

openssl s_client -connect example.com:443 \
  -verify_hostname example.com -verify_return_error

Quick Check

A developer sets verify=False to silence a certificate error in production. What risk does this introduce?

Recap

You learned how clients perform certificate validation.

Checks include chain trust, validity dates, revocation, and hostname (SAN).
Pinning adds defense against rogue CAs.
Never disable validation in production.

Next, we look at common attacks against TLS.

Frequently asked questions

Is the “Certificate Validation” lesson free?

Yes — the full text of “Certificate Validation” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Certificate Validation”?

Verify server identity. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Certificate Validation” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy