ISLAB Logs

The sender hashes the data and transforms the hash with the private key; the receiver recomputes the hash and checks it against the signature using the sender's public key. Sender (signer): Runs a hash function (e.g. SHA-256) over the data, giving a short fixed-size fingerprint....

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

Publishing the root certificate into Active Directory lets Group Policy push it into every domain member's trusted root store; the Linux client is not in the domain, so the root never reaches its trust store. The offline root CA is not joined to the domain, so AD knows nothing ab...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

The server now demands a client certificate and the user has none, so the TLS handshake fails; autoenrollment issues every user a certificate automatically. The browser shows a connection error rather than a login page: the server refuses the handshake because the client sent no...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

It proves who published the code and that it has not been changed since it was signed; it does not prove the code is safe. The publisher hashes the program or script and signs the hash with a code-signing private key. Before running it, the operating system checks the signature a...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

Only that the connection is encrypted to a party presenting a certificate for this host name that chains to a root your device trusts; not that this party is the real site, nor that nobody in between can read along. The padlock is a statement about the TLS connection and the loca...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

It expires at its "not after" date, or the CA revokes it early and publishes that in a CRL or through an OCSP responder. Expiry. Every certificate carries a validity period. After not after it is invalid without anyone doing anything. Short lifetimes limit the damage of a key no...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

It generates a new 4096-bit RSA key pair (saved unencrypted as www-private.key) and a CSR (www.csr) that carries the public key plus the requested name and extensions, signed with the private key. Two outputs, three components: The private key (www-private.key), written in /etc/...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

Duplicate the User template and give Domain Users Read, Enroll and Autoenroll; publish the template on the CA; enable "Certificate Services Client – Auto-Enrollment" in a GPO linked to the users' OU. Duplicate the template. In Certificate Templates (Manage), copy the built-in Us...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

Restricted runs no scripts, AllSigned only signed ones, RemoteSigned requires signatures only for downloaded scripts, Unrestricted runs all (warning for downloaded ones), Bypass runs all silently. Policy Behaviour Restricted Interactive commands only; no script files (.ps1...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026

Make it the client's default gateway, enable IP forwarding, and redirect TCP ports 80 and 443 with nftables to the local port of mitmproxy running in transparent mode. A man-in-the-middle must sit on the path of the traffic. An attacker gets there by spoofing (ARP or DHCP spoofin...

Quiz: ISLAB / Public Key Infrastructure | updated: Oct 20, 2026