Today I reviewed results from the current assignment: build an automated CA, and I must say I have mostly been impressed by the results and the thoughtfulness of students. First they had to code a simple HTTP-like server (and I recommended doing it in bash). Then they had to use openssl to handle the CA-operations. And finally they had to implement a hand-crafted Challenge-Response-Protocol for authorization. The latter used the results from a former assignment that included coding bignum-arithmetik, Diffie-Hellman key exchange and the Viginere-Cipher (using the shared secret from the DH-exchange as key). Most teams handled freshness and unpredictability of the nonce pretty well and, of course, some students pushed the cart a few paces further. For example by creating new, inventive HTTP status codes, using message-handlers to separate HTTP-server and cryptographic operations (the registration authority), setting up different users, directories and elaborate README-files explaining everything. The task, actually both of them, were perceived as very challenging (I agree) but I got some statements on the large amount of stuff that could be learned along the way. Thus I must state: teachers, please do not underestimate your students but give them challenges and space to act.