Lesson 3 of 8 · 10 min read
Trust on the Wire: HSTS, Certificate Transparency, Pinning and Interception
TLS protects traffic only when the client correctly decides to trust the server's certificate. HSTS stops browsers downgrading to HTTP or letting users click through warnings; Certificate Transparency makes mis-issued certificates visible; CAA records restrict which CAs may issue for a domain; pinning narrows trusted keys for clients you control; and interception proxies deliberately insert a private root, creating a new trusted point with its own risks. Operating these well means automated certificate management, staged rotation, monitoring, and knowing which failures are attacks and which are configuration.
free sign-in, no card required
Practise it as an interviewer asks it
What happens, security-wise, from typing a URL to seeing the page? Name the attack and the defence at each step.How does a man-in-the-middle attack get into position on a network, and which property of TLS actually stops it?Walk through a TLS 1.3 handshake. What does each step protect against?What is SSRF, and why do LLM tools that fetch URLs bring it back?How is a certificate chain validated, and what goes wrong in practice?What is SSL stripping, how does HSTS prevent it, and what are the risks and limits of HSTS and preloading?