EXERCISE 1 — Reading a real certificate's fields
=================================================

Command:
  openssl s_client -connect example.com:443 -servername example.com </dev/null \
    | openssl x509 -text -noout

  (-servername sends SNI so multi-site servers return the RIGHT cert;
   </dev/null stops s_client hanging; -noout suppresses the raw PEM dump.)

WHAT TO LOCATE in the output and write down:

  Subject:        CN=example.com
                  -> the identity the cert claims to represent.

  Issuer:         C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
                  -> the CA that signed it (the next link up — Chapter 5).
                  Note Subject != Issuer, so this is a leaf cert signed by
                  someone else (not self-signed).

  Validity:
      Not Before: Jan  1 00:00:00 2025 GMT
      Not After : Apr  1 23:59:59 2025 GMT
                  -> the date window; outside it the cert is rejected.

  Public key:     Public Key Algorithm: rsaEncryption, (2048 bit)
                  -> the server's public key and its type/size. (Many modern
                  certs show "id-ecPublicKey (256 bit)" instead — EC keys.)

  Subject Alternative Name:
      DNS:example.com, DNS:www.example.com
                  -> the actual list of domains this cert is valid for.

HOW TO READ IT:
  - Every Chapter-4 concept appears: identity (Subject), the key being
    bound (Public Key), who vouched (Issuer), the time window (Validity),
    and the domains covered (SAN).
  - If Subject == Issuer, the cert is SELF-SIGNED (it vouches for itself —
    no external CA), which browsers don't trust by default.