For Teachers · Back to the Module · Print with your browser's Print command.

P4 Teacher Answer Key: TLS, Certificates and HTTPS

Teacher Answer Key (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P3

Learning Objectives

• [ ] Explain why TLS 1.0 and 1.1 are deprecated.
• [ ] Recognise expired, self-signed and mismatched certificates.
• [ ] Explain what HSTS and HTTP-to-HTTPS redirects protect against.

Key Terms

Write each definition in your own words.

• TLS: Transport Layer Security: the protocol that encrypts connections such as HTTPS.
• Certificate: A signed digital document that binds a public key to names such as a website's domain, used by TLS to prove identity.
• HSTS: HTTP Strict Transport Security: a header that tells browsers to use only HTTPS for a site.
• Downgrade Attack: Forcing a connection to use a weaker protocol or no encryption, for example from HTTPS to HTTP.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only NET-TLS-,WEB-TLS-001,WEB-HDR-001
2. On your own server: openssl s_client -connect 127.0.0.1:443 -tls1_1 </dev/null and explain the result.

Self-Check Questions

1. Which TLS versions should a server offer today?

• [ ] a) TLS 1.0 and above
• [x] b) TLS 1.2 and TLS 1.3
• [ ] c) SSL 3.0 and TLS 1.0
• [ ] d) TLS 1.1 and TLS 1.2
• Answer: b. RFC 8996 deprecated TLS 1.0 and 1.1, so only TLS 1.2 and 1.3 remain.

1. What does HSTS do?

• [ ] a) Encrypts the database
• [x] b) Tells browsers to always use HTTPS for the site
• [ ] c) Blocks bots
• [ ] d) Hides the server version
• Answer: b. Strict-Transport-Security makes browsers refuse to downgrade to plain HTTP for that site.

1. Why are self-signed certificates a problem on public sites?

• [x] a) Browsers do not trust them, so users learn to ignore warnings
• [ ] b) They expire faster
• [ ] c) They use weak keys
• [ ] d) They cannot be used with TLS 1.3
• Answer: a. Users trained to click through warnings lose their protection against interception.

1. Which RFC deprecated TLS 1.0 and TLS 1.1?

• [ ] a) RFC 6797
• [x] b) RFC 8996
• [ ] c) RFC 9142
• [ ] d) RFC 5246
• Answer: b. RFC 8996 (2021) deprecated them. RFC 6797 defines HSTS, RFC 9142 covers SSH key exchange and RFC 5246 defines TLS 1.2.

1. A valid certificate lists only www.example.com. A user visits shop.example.com on the same server. What happens?

• [ ] a) Nothing, any certificate from that server works
• [x] b) The browser warns that the name does not match
• [ ] c) The connection falls back to TLS 1.0
• [ ] d) HSTS fixes the mismatch
• Answer: b. A certificate proves identity only for the names it lists. Any other name gets a mismatch warning.

1. How does OpenVAPT test for old TLS versions?

• [ ] a) It reads the certificate expiry date
• [x] b) It attempts handshakes limited to the old versions against 127.0.0.1
• [ ] c) It scans other servers on the internet
• [ ] d) It checks the HSTS header
• Answer: b. If a handshake limited to TLS 1.0 or 1.1 succeeds on loopback, the server still offers it.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• RFC 8996, Deprecating TLS 1.0 and TLS 1.1: https://www.rfc-editor.org/rfc/rfc8996.html
• NIST SP 800-52 Rev. 2, Guidelines for TLS Implementations: https://csrc.nist.gov/pubs/sp/800/52/r2/final
• RFC 6797, HTTP Strict Transport Security: https://www.rfc-editor.org/rfc/rfc6797.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.