Cryptography and PKI Explained: Hashing, Encryption and Certificates (Security+)

ReferenceOctober 31, 2026

ExplainerLevel beginnerTime ~20 minTool OpenSSL, PowerShellCost freeExam Sec+ 1 · also 3, 4

What you’ll know

The difference between hashing and encryption, symmetric vs asymmetric keys, how a digital signature proves who sent something and that nobody changed it, and what the certificate behind the padlock actually says. Then do all four yourself.

Why it matters. Cryptography sits under nearly every Security+ domain: passwords are hashed, Wi-Fi and VPNs are encrypted, software updates are signed and websites prove who they are with certificates. Get these four ideas straight and a big slice of the exam gets easier.

Four tools, four jobs

Tool	What it does	Reversible?	Common examples
Hashing	Turns any input into a fixed-length fingerprint. Change one character and the fingerprint changes completely.	No (one-way)	SHA-256 (good). MD5 and SHA-1 are broken: don’t use them for security.
Symmetric encryption	Locks and unlocks data with one shared key. Fast, so it’s used for the actual data.	Yes, with the key	AES-256, ChaCha20
Asymmetric encryption	Uses a key pair: a public key anyone can have and a private key only the owner keeps.	Yes, with the other key of the pair	RSA, ECC (elliptic curve)
Digital signature	The sender hashes the message and signs the hash with their private key; anyone checks it with the public key.	Proves origin and integrity, doesn’t hide the message	Signed software updates, signed email, certificates

How they work together in HTTPS

Your browser gets the site’s certificate, which contains the site’s public key and is signed by a certificate authority (CA).
The browser checks that signature against CAs it already trusts (the chain of trust: root CA → intermediate CA → the site).
Asymmetric crypto is used to agree on a fresh symmetric session key; from then on, the fast symmetric cipher (usually AES) protects the traffic.
Each record is integrity-checked as it arrives, so tampering is detected.

Words the exam loves

Term	Plain meaning
Salt	Random data added to a password before hashing, so two people with the same password get different hashes and pre-computed “rainbow tables” stop working.
Key stretching	Hashing a password many thousands of times (PBKDF2, bcrypt, Argon2) so each guess is slow for an attacker.
Non-repudiation	The sender can’t later deny sending it, because only their private key could have made the signature.
PKI	Public key infrastructure: the CAs, certificates and rules that let strangers trust public keys.
CRL / OCSP	Ways to check whether a certificate has been revoked before it expires.
Self-signed certificate	Signed by its own key instead of a CA. Fine in a lab; browsers warn on the public internet.
Key escrow	A trusted third party keeps a copy of a key so data can be recovered.

A hash is a fingerprint, not a safe. You can’t un-hash a password; you can only guess, hash the guess and compare. That’s why the length of the password is the whole game. — Nyx

Try it 1: hashing

Linux or WSL (bash)

$ echo -n "hello" | sha256sum
 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824  -
$ echo -n "hello!" | sha256sum
 ce06092fb948d9ffac7d1a376e404b26b7575bcc11ee05a4615fef4fec3a308b  -

One extra character and the whole fingerprint changes. Everyone who hashes “hello” with SHA-256 gets exactly the same result, on any computer.

Windows PowerShell

PS> Set-Content -Path hello.txt -Value 'hello' -NoNewline
PS> Get-FileHash .\hello.txt -Algorithm SHA256
 SHA256  2CF24DBA5FB0A30E26E83B2AC5B9E29E1B161E5C1FA7425E73043362938B9824
PS> certutil -hashfile hello.txt SHA256

Same fingerprint as Linux (Windows just prints it in capitals). This is how you check that a downloaded file matches the hash its publisher lists.

Try it 2: symmetric encryption (AES-256)

Linux or WSL (bash)

$ echo "meet at noon" | openssl enc -aes-256-cbc -pbkdf2 -salt -pass pass:demo-only -base64 > secret.txt
$ cat secret.txt
 U2FsdGVkX182ebtZT4mNRL5KS1Mq+CnC8luS01+o1/s=
$ openssl enc -d -aes-256-cbc -pbkdf2 -pass pass:demo-only -base64 -in secret.txt
 meet at noon

The same key locks and unlocks it. Your scrambled text will look different from ours every time, because -salt adds random data. (Typing a password on the command line is fine for a demo, but it lands in your shell history, so don’t do it with real secrets.)

Try it 3: a digital signature

Linux or WSL (bash)

$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem
$ openssl pkey -in private.pem -pubout -out public.pem
$ echo "pay Nyx 10 dollars" > note.txt
$ openssl dgst -sha256 -sign private.pem -out note.sig note.txt
$ openssl dgst -sha256 -verify public.pem -signature note.sig note.txt
 Verified OK
$ echo "pay Nyx 1000 dollars" > note.txt
$ openssl dgst -sha256 -verify public.pem -signature note.sig note.txt
 Verification failure

Change one word and the signature no longer matches, so nobody can quietly add zeros. (OpenSSL also prints a couple of “bad signature” error lines after the failure; that’s expected.)

Try it 4: read a real certificate

Linux or WSL (bash)

$ openssl s_client -connect stashgrid.ai:443 -servername stashgrid.ai </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
 subject=CN = *.stashgrid.ai
 issuer=C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV R36
 notBefore=Sep  4 00:00:00 2026 GMT
 notAfter=Mar  3 23:59:59 2027 GMT

The subject is who the certificate is for (a wildcard covering every stashgrid.ai subdomain), the issuer is the CA that signed it, and the dates show it’s valid for about six months. “DV” means domain validated: the CA checked that we control the domain, not who we are. Try it on any site you use.

Where this fits

This is part of the free CompTIA Security+ roadmap: every StashGrid lesson mapped to the exam domains.

NextRisk management: SLE, ALE and the four responses→

Go deeper

Strong passwords and passphrases — why length beats complexity against hash cracking
WireGuard VPN lab — public and private keys in a real tunnel
DNSSEC explained — signatures protecting DNS answers

Explainer, written by StashGrid with AI help and checked against the CompTIA Security+ V8 (SY0-801) exam objectives before publishing. Every command was run in Ubuntu 24.04 (WSL, OpenSSL 3.0.13) and Windows 11 PowerShell on 30 Oct 2026. StashGrid isn’t affiliated with CompTIA. Spotted an error? Tell us.