EXERCISE 1 — Triggering deliberate certificate errors with badssl.com
=====================================================================

badssl.com hosts subdomains that intentionally present broken certs. Visit
in a browser, or probe with openssl:

  openssl s_client -connect expired.badssl.com:443 -servername expired.badssl.com </dev/null
  openssl s_client -connect wrong.host.badssl.com:443 -servername wrong.host.badssl.com </dev/null
  openssl s_client -connect self-signed.badssl.com:443 -servername self-signed.badssl.com </dev/null
  openssl s_client -connect untrusted-root.badssl.com:443 -servername untrusted-root.badssl.com </dev/null

(In openssl, look at the "Verify return code" line near the bottom.)

CASE 1 — expired.badssl.com
  Browser error : NET::ERR_CERT_DATE_INVALID
  openssl       : verify error: certificate has expired (code 10)
  FAILED CHECK  : Validity window (Not After date is in the past).
  MAPS TO       : Chapter 4 (validity dates).

CASE 2 — wrong.host.badssl.com
  Browser error : NET::ERR_CERT_COMMON_NAME_INVALID
  openssl       : (cert verifies as trusted, but hostname doesn't match SAN)
  FAILED CHECK  : Hostname / SAN matching -- the visited host isn't in the
                  cert's Subject Alternative Name list.
  MAPS TO       : Chapter 4 (SAN, not CN, is what's checked).

CASE 3 — self-signed.badssl.com
  Browser error : NET::ERR_CERT_AUTHORITY_INVALID
  openssl       : verify error: self signed certificate (code 18)
  FAILED CHECK  : Chain to a trusted root -- Subject == Issuer, terminates
                  at itself, which isn't in the trust store.
  MAPS TO       : Chapter 5 (self-signed / trust anchor).

CASE 4 — untrusted-root.badssl.com
  Browser error : NET::ERR_CERT_AUTHORITY_INVALID
  openssl       : verify error: self signed certificate in certificate chain
                  (code 19)
  FAILED CHECK  : Chain to a TRUSTED root -- the chain ends at a root CA
                  that is NOT in the trust store (a real chain, just not
                  trusted).
  MAPS TO       : Chapter 5 (chain of trust / trust store membership).

TAKEAWAY:
  Every "your connection is not private" page is one of these checks
  failing: in-date? (Ch.4 validity), name matches? (Ch.4 SAN), chains to a
  trusted root? (Ch.5). Reading the exact error tells you precisely what to
  fix. (See also: untrusted-root vs self-signed differ by whether there's a
  separate CA cert in the chain at all.)