Labs · Cyber Security

Lab: Check an HTTPS Certificate Chain in Your Browser and Verify a Download with Its Published SHA-256 Hash

By Ravindra Bagale · Last updated: 8 October 2026

Suppose we are…

Suppose we are on the IT security team at ICICI Bank. Staff ask two everyday questions: "How do I know this website's padlock is genuine?" and "How do I know this tool I downloaded was not tampered with?" We prepare a 10-minute demo: reading a certificate chain, and verifying the popular SSH client PuTTY against the SHA-256 list its authors publish.

Goal of this lab

By the end you will be able to:

• Read a site's certificate: who it is issued to, who issued it, the chain up to a trusted root, and the expiry date.
• Check the same details from the command line with openssl.
• Verify a real download against a published SHA-256 hash and see what a mismatch looks like.

What you need (all free)

• A browser and internet access. Optional: openssl (built into Mac/Linux, and Git Bash on Windows).
• About 30 minutes.

Part 1: certificate chain in the browser

1. Open https://ravindrabagale.com (or any HTTPS site). Click the icon left of the address (Chrome/Edge: the tune icon or padlock) → Connection is secure → Certificate is valid.

2. On the General tab read Issued To, Issued By and Validity Period.

   👁 What you should see: Issued To matches the domain, Issued By is a certificate authority (for example Let's Encrypt), and an expiry date about 90 days after the issue date.

3. Open the Details tab and look at Certificate Hierarchy.

   👁 What you should see: three levels: a root at the top (trusted by your device), an intermediate in the middle, and the site's leaf certificate at the bottom.

4. Click the leaf and find Subject Alternative Name: the list of domain names the certificate covers.

Part 2: the same check with openssl (optional)

5. In a terminal:

   echo | openssl s_client -connect ravindrabagale.com:443 -servername ravindrabagale.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates
   

   👁 What you should see: subject=CN=ravindrabagale.com (older openssl adds spaces around =), an issuer= line such as O=Let's Encrypt, and notBefore= and notAfter= dates that match the browser.

Part 3: verify a download with SHA-256

6. Download the 64-bit PuTTY program from the official page https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html → Alternative binary files → under putty.exe (the SSH and Telnet client itself) click the 64-bit x86 putty.exe. You do not need to run it; we only hash it, so this works on Mac and Linux too.
7. On the same page click SHA-256 under Checksum files (the sha256sums file) and find the line ending with w64/putty.exe (not the one marked "installer version").

8. Hash your download. Windows PowerShell: Get-FileHash .\putty.exe -Algorithm SHA256 · Mac: shasum -a 256 putty.exe · Linux: sha256sum putty.exe

   👁 What you should see: exactly the same 64-character value as the w64/putty.exe line. Same hash = same file the authors published.

9. Simulate tampering on a copy: copy putty.exe to putty-copy.exe, append one character (Mac/Linux: echo x >> putty-copy.exe; PowerShell: Add-Content .\putty-copy.exe "x"), and hash the copy.

   👁 What you should see: a completely different hash. Delete putty-copy.exe.

10. Write two lines for the staff demo: what the padlock proves (you are talking to the real domain, encrypted), and what a matching hash proves (the file is exactly what the publisher released).

Common mistakes

Self-check checklist

Try-at-home challenge

Use the openssl command from step 5 on three sites you use every day. Which one expires soonest, and how many days are left?

Samjla ka? The chain proves who, the hash proves what. Aata pudhe jaauya: Chapter 34 covers Indian cyber law and how to report a crime.