How does your browser know that https://example.com is actually talking to example.com?
What happens when someone tries to get in the middle?

In this hands-on tutorial, we'll build the answer from scratch using Python. Starting with RSA keys, we'll progressively construct X.509 certificates, become our own Certificate Authority, secure a Flask server, and teach a Python client what it means to trust someone.

Then we'll break it. Through a series of small coding exercises and experiments, we'll explore certificate chains, identity, trust, and finally a man-in-the-middle attack — seeing first-hand why TLS rejects the attack, and what happens when we change the trust relationship.

No PKI expertise required. Bring your laptop, your curiosity, and a healthy suspicion of Certificate Authorities.

Outline

1. RSA fundamentals: keys, encryption, and signatures
2. Certificates: X.509, identities, Subjects and Issuers
3. Build a CA: issue and verify certificates
4. Trust: connect a Python client to a TLS-enabled Flask server
5. MITM: intercept the connection and discover why trust matters
6. Break it: diagnose broken certificates and trust chains