Security Essentials: JWT, TLS & SSH
Understand the security under every login, certificate and server you touch.
Every API you call carries a JWT, every connection rides on TLS, and every server is reached over SSH. Most engineers use all three without understanding them, until a token is forged or a certificate expires at 3am. This track takes each one apart with real tools in your browser: you sign and break JWTs, run your own certificate authority, and drive a real SSH server, so you can explain and debug them under pressure.
By the end, you can
- Tell encoding, hashing, HMAC, encryption and signatures apart, and use each with openssl
- Decode, sign and validate JWTs, and exploit and fix alg:none and key-confusion bugs
- Run asymmetric JWT auth with a JWKS and rotate signing keys without downtime
- Build a CA, read certificates, debug broken TLS, and run mutual TLS with revocation
- Use SSH keys, jump hosts, tunnels and SSH certificates, then secure a service end to end
What's inside
Where this track goes
The first lessons are free — no card. Pro unlocks the production depth that turns this into a job-ready skill.
Free — you can do this
Free0 / 2 free lessons complete
Encoding, hashing, HMAC & encryption
base64, SHA-256, HMAC and AES with openssl, and which guarantee each gives.
Anatomy of a JWT
Decode a real token by hand: base64url, registered claims, expiry, signature bytes.
Pro — what you unlock next
ProKeys & digital signatures
Ed25519, ECDSA and RSA keys; sign, verify, and catch a tampered release.
HS256 from scratch
Sign and verify a JWT with only openssl, then cross-check it with PyJWT.
Validating claims
Algorithm allow-list, aud/iss, expiry with leeway, required claims, and scopes.
JWT attacks
Forge alg:none and RS256→HS256 key-confusion tokens, crack a weak secret, then fix the verifier.
JWKS & key rotation
ES256 with kid, a published JWKS, and rotating keys without downtime.
Certificates up close
Subject, SANs, key usage, expiry checks, fingerprints, and PEM/DER/PKCS#12.
Build your own CA
Root → intermediate → leaf with openssl, and why chains break.
The TLS handshake, live
TLS 1.3 message by message with s_client, TLS 1.2, SNI and ALPN.
Debugging broken TLS
Expired, wrong host, missing intermediate, self-signed, key mismatch: diagnosed from the error.
Mutual TLS & revocation
Client certificates, a CRL the server enforces, and a live OCSP responder.
SSH keys & host verification
Ed25519 keys, authorized_keys, known_hosts, and a simulated man-in-the-middle.
SSH config, agents & jump hosts
~/.ssh/config, ssh-agent, ProxyJump through a bastion, and the agent-forwarding risk.
SSH tunnels & file transfer
-L, -R and -D forwarding, scp/sftp, and ControlMaster multiplexing.
SSH hardening & certificates
sshd -T audits, forced-command keys, and SSH user and host certificates.
Capstone
Secure a service end to end: private CA, TLS, ES256 JWTs with a JWKS, and SSH-only access.
Ready to start?
Create a free account to save progress across every track.