Certificate Triage Lab
A bad certificate does not announce itself — it is one field out of ten that is wrong. Work a queue of decoded X.509 certificates and call each one: healthy, or name the defect — an expired or expiring cert, a SHA-1 signature, a 1024-bit key, a SAN that does not cover the host, a self-signed production leaf, an over-broad wildcard, a broken chain, or key usage that does not fit the job. You are scored on catch rate against false positives — because flagging a healthy cert (a strong ECDSA key, a correctly-scoped wildcard) is its own failure. Clear the queue clean.
The real job. More noise, a tighter clock.
Triage queue
Call each certificate as of the snapshot 2026-10-14: OK, or the specific finding.
#1
www.northwind.com
purpose: Public TLS — production storefront
#2
api.northwind.com
purpose: Public TLS — production API
#3
legacy.northwind.com
purpose: Internal TLS — intranet app
#4
vpn.northwind.com
purpose: Public TLS — remote-access portal
#5
dashboard.northwind.com
purpose: Public TLS — customer dashboard (production)
#6
shop.northwind.com
purpose: Public TLS — checkout (production)
#7
cdn.northwind.com
purpose: Public TLS — asset CDN (production)
#8
mail.northwind.com
purpose: Public TLS — mail front-end
#9
*.com
purpose: Public TLS — multi-tenant edge
#10
reports.northwind.com
purpose: Public TLS — reporting portal
#11
sso.northwind.com
purpose: TLS server — SSO endpoint
#12
*.northwind.com
purpose: Public TLS — HR microsite
#13
billing.northwind.com
purpose: Public TLS — billing (PCI scope)
#14
old-intranet.northwind.com
purpose: Internal TLS — legacy intranet
Catch rate vs. false positives
Triage each cert, then grade. So far 0/14 called, 0/11 problems caught, 0 false positive(s).
How it is scored
Catch rate = problem certs given the exact right finding.
A false positive (flagging a clean cert) takes an extra hygiene bite — a queue that cries wolf is as useless as one that misses.
Harder tiers add subtler certs and deliberate traps (strong ECDSA, correctly-scoped wildcards, internal-CA leaves).
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based certificate-triage lab: work a queue of ~20 decoded X.509 certificates and call each one OK or name its specific defect.
- Problems seeded across the queue: expired, expiring-soon (<30d), weak signature (SHA-1/MD5), short RSA key (<2048), SAN/hostname mismatch, self-signed in production, wildcard misuse, missing intermediate, and key-usage wrong for purpose.
- You are graded on catch rate weighed against false positives — flagging a healthy certificate takes an extra hygiene penalty, because a queue that cries wolf is as useless as one that misses.
- Difficulty tiers add subtler certs and deliberate traps: strong ECDSA P-256/P-384 keys, correctly-scoped wildcards, and internal-CA-issued leaves that are not self-signed.
- All expiry calls are made against a fixed snapshot date, and after grading every cert shows why the right verdict is right.
Frequently asked questions
What is the Certificate Triage Lab?
A free, in-browser exercise where you work a queue of decoded X.509 certificate summaries — subject, issuer, SAN list, validity dates, signature algorithm, public-key algorithm and size, the basicConstraints CA flag, and key usage — and give each one a verdict: OK, or a specific problem such as expired, weak signature, short key, SAN mismatch, self-signed, wildcard misuse, missing intermediate, or key usage wrong for purpose. You are scored on how many real problems you catch versus how many clean certs you wrongly flag.
How is it graded?
Each certificate has one correct verdict. Your catch rate is the share of problem certs you identify with the exact right finding. False positives — flagging a healthy certificate — carry an extra hygiene penalty, because an alert queue analysts cannot trust is as useless as one that misses defects. A perfect run calls every certificate exactly right, clean ones included.
Does it parse real certificates?
No. Nothing is uploaded and no PEM is parsed. The certificates are authored, realistic decoded field summaries bundled with the page, and every expiry decision is made against a single fixed snapshot date so the queue is deterministic and never goes stale. It runs entirely in your browser — no account, no install, nothing sent anywhere.
Who is it for?
Platform and security engineers who manage TLS and PKI, analysts triaging certificate inventory and scan output, and anyone prepping for a security or infrastructure interview who wants to feel why a 1024-bit key, a SHA-1 signature, a self-signed production leaf or an over-broad wildcard are findings — and why a strong ECDSA key or a correctly-scoped wildcard is not.