Cryptography & PKI Labs
The canonical home for everything PlayCISO has on cryptography and public key infrastructure: 20 interactive labs that take you from a jumbled certificate chain all the way down to the bytes of a DER structure — plus the TLS transport layer and the primitives (hashing, HMAC, authenticated encryption, digital signatures, key management) underneath it. You do not read about cryptography here; you work with real certificates, real ciphertext and real signatures and watch them succeed or fail. Everything runs in your browser — no signup, nothing uploaded.
In plain words
PlayCISO offers 20 free, browser-based cryptography and PKI labs covering X.509 certificates, certificate chains, OCSP/CRL revocation, CA hierarchy design, TLS 1.2/1.3 hardening and handshakes, mutual TLS, hashing, HMAC, AES-GCM encryption, RSA/ECDSA digital signatures, JWTs, password storage, key lifecycle, Certificate Transparency and entropy.
Each lab runs entirely in your browser with no signup — you operate real certificates, chains, ciphertext and signatures instead of reading about them, and a validator scores your decisions.
Together they cover the full certificate and PKI lifecycle, the TLS transport layer, and the cryptographic primitives every security engineer is expected to know.
All 20 labs
Grouped by theme. Start anywhere — each lab is self-contained and free.
Certificates & PKI
The certificate and public-key-infrastructure lifecycle — issuing, chaining, revoking, rotating, pinning and monitoring X.509.
Flag the broken certs in a queue of 20 — expired, SHA-1, short key, SAN mismatch.
Assemble a valid cert chain from a jumble; catch the missing intermediate.
Design a CA hierarchy; a validator scores it against best practice.
Decide valid / revoked / unknown from OCSP & CRL evidence — and the right action.
Work a cert fleet’s renewal queue and prevent expiry outages under limited capacity.
Rotate a pinned certificate with zero client breakage — learn backup pins.
Audit CSRs for mistakes, or build a correct one — CN, SANs, key strength.
Spot the mis-issued / rogue certs for your domain in a CT feed.
Decode real DER into a TLV tree and identify the X.509 structures.
TLS & transport security
How TLS actually negotiates, where it breaks, and how to harden it without breaking clients.
Cryptographic primitives
The building blocks — hashing, message authentication, authenticated encryption, digital signatures and randomness.
Verify integrity with live SHA-256/512 — and learn why MD5/SHA-1 are retired.
Compute & verify real HMAC tags; catch tampering and the length-extension trap.
Encrypt with real AES-GCM; see the nonce-reuse catastrophe and tag tampering fail-closed.
Sign & verify with real RSA-PSS/ECDSA, tamper to break it, and catch the forgeries.
Measure real Shannon entropy and spot the predictable keys (Debian 2008).
Keys, secrets & tokens
Storing secrets safely, managing keys over their lifetime, and the token formats that carry them.
Related tools
The full catalog of interactive security labs — network, identity, cloud, detection, forensics and OT alongside cryptography.
Identity Risk CalculatorScore a human, service or AI identity 0–100 — including its credential and key posture.
Password Token Half-LifeReason about how long a password or token stays useful to an attacker.
Zero Trust MaturityBenchmark a zero-trust program where strong, phishing-resistant authentication lives.
Related reading
Passkeys and FIDO2 hardware security keys are both WebAuthn credentials, but they differ in portability, assurance and where they belong.
FIDO2 and Passkeys: Benefits, Options, and How to Assess ThemWhy WebAuthn credentials are phishing-resistant, platform vs hardware and device-bound vs synced options, attestation and AAGUID, and an assessment checklist.
The Benefits of FIDO2 and Passkeys for the WorkforceOrigin-bound public-key credentials give the workforce phishing-resistant sign-in that is also faster and cheaper than passwords.
Frequently asked questions
What is PKI?
PKI (public key infrastructure) is the system of certificate authorities, certificates, and revocation mechanisms that lets parties trust each other’s public keys. An X.509 certificate binds a public key to an identity (such as a domain name), a CA signs it, and clients verify the chain back to a trusted root. PlayCISO’s PKI Hierarchy, Certificate Chain, Certificate Triage, Cert Revocation and CT Log labs let you build, validate and break these pieces hands-on.
How do I learn certificate management?
Work real certificates instead of reading about them. Start with the Certificate Triage Lab to spot broken certs, then the Certificate Chain Lab to assemble a valid chain, the Cert Revocation Lab to read OCSP and CRL evidence, and the Cert Rotation War Room to prevent expiry outages across a fleet. The CSR Builder & Auditor and ASN.1 / DER Decoder labs take you down to how certificate requests and the certificates themselves are actually structured.
Are these cryptography labs free?
Yes. All 20 cryptography and PKI labs are free and run entirely in your browser — no signup, no account, and nothing is uploaded. You can work through them in any order. PlayCISO also offers paid tiers ($5, $10 and $40) for its broader platform, but the labs on this page are part of the free tier.
What is the difference between hashing, encryption and signing?
Hashing is a one-way fingerprint for integrity (you cannot recover the input) — see the Hashing & Integrity Lab. Encryption is reversible and protects confidentiality; authenticated encryption like AES-GCM also detects tampering — see the AES-GCM Encryption Lab. Signing uses a private key to prove authenticity and integrity, and anyone with the public key can verify it — see the Digital Signature Lab. HMAC sits alongside as a shared-secret way to authenticate a message.
Do I need to install anything or know how to code?
No. Every lab runs client-side in a modern browser with JavaScript — there is nothing to install and no command line required. The labs use real cryptographic operations (real SHA-256/512 hashes, real AES-GCM, real RSA-PSS/ECDSA signatures), so you see genuine behaviour, but the interface is point-and-click with guided feedback and scoring.
Which cryptography lab should I start with?
If you manage TLS or certificates day to day, start with the Certificate Triage Lab and the TLS Handshake Lab. If you build applications, start with the Password Storage Lab, the JWT Attack & Defense Lab and the AES-GCM Encryption Lab. If you want fundamentals, do Hashing & Integrity, then HMAC, then Digital Signatures, then Key Lifecycle in that order.