Certificates & Proofs / PKI Workshop

What you will do: Work through five steps: generate a CSR, create a Root CA, issue a certificate by signing the CSR with that CA, parse the certificate, then build a CRL.

Worked example: Generate a CSR for example.com with a new RSA 2048-bit key, self-sign a Root CA, press Sign Certificate to issue the leaf, then Parse Details shows its subject and issuer.

Runtime and privacy: The cryptographic exercise runs in this browser. Review the site privacy terms before entering sensitive material; use synthetic inputs for learning and evaluation.

Browse all Crypto Lab tools · Learn with PKI

For your role

Developer / Engineer

Step 1 generates a key and a CSR (choose the key source and a profile), Step 2 creates a root CA, Step 3 issues the certificate, Step 4 parses it and Step 5 revokes it with a CRL: the Console Output is the OpenSSL you would run.

Security Architect

Pick a profile in Select Profile and read the constraints it applies, then compare the parsed certificate in Step 4: the fields and sizes are what a PQC key changes in a chain.

Researcher / Academic

Use the Console Output at each step to reproduce the CSR, CA, issuance and CRL outside the browser.

IT Ops / DevOps

Run the five steps once with the default RSA key to see the full issue-and-revoke cycle, then note the Step 5 CRL: it is the artefact your revocation distribution has to carry.

Curious Explorer

Follow the five steps in order: you make a request, create an authority, get a certificate issued, read what is inside it, and revoke it — the whole life of a certificate in one sitting.