Chapter 29 — Cryptography and trust services: operations
Lesson map
Lesson 29 published. Map, example, EX085.
flowchart TD
N0["Learning outcomes"]
N1["29.1 Certificate operations"]
N2["Lab — Certificate windows"]
N3["29.2 Reading the windows"]
N4["29.3 Routine rotation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX085"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["29.1 Certificate operations"]
N2["Lab — Certificate windows"]
N3["29.2 Reading the windows"]
N4["29.3 Routine rotation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX085"]
[Learning outcomes]
|
v
[29.1 Certificate operations]
|
v
[Lab — Certificate windows]
|
v
[29.2 Reading the windows]
|
v
[29.3 Routine rotation]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX085]
Learning outcomes
You will (1) operate certificate renewal and monitoring; (2) read certificate lifetimes and renewal windows; (3) run routine key rotation.
29.1 Certificate operations
Following the lessons of Chapter 20, Tidewell automates certificate renewal for its public sites with ACME, the protocol in RFC 8555, and monitors expiry dates centrally. Industry practice is moving toward shorter certificate lifetimes, which limit the damage from leaked keys but require reliable automation. Priya reviews the consortium's certificates as of a synthetic date to check renewal windows and spot certificates still renewed by hand. She uses the review to decide which remaining certificates should move to automation first. Priority goes to services that patrons use directly, since their outages are most visible and most damaging to trust.
Lab — Certificate windows
"""Certificate validity windows for a synthetic consortium, with the shorter lifetimes trend."""
from datetime import date, timedelta
TODAY = date(2026, 9, 1)
SITES = [("catalog", date(2026, 7, 10), 90), ("patron-portal", date(2026, 6, 20), 90),
("ebooks", date(2025, 10, 1), 397), ("staff-wiki", date(2026, 8, 15), 47)]
def main():
for name, issued, life in SITES:
exp = issued + timedelta(days=life); left = (exp - TODAY).days
print(f"{name:<14} life {life:>3} d expires {exp} left {left:>4} d")
print("renew soon (<21 d):", [n for n, i, l in SITES if (i + timedelta(days=l) - TODAY).days < 21])
if __name__ == "__main__":
main()
Run with python3 lab_certdays.py. Verified output:
catalog life 90 d expires 2026-10-08 left 37 d
patron-portal life 90 d expires 2026-09-18 left 17 d
ebooks life 397 d expires 2026-11-02 left 62 d
staff-wiki life 47 d expires 2026-10-01 left 30 d
renew soon (<21 d): ['patron-portal']
29.2 Reading the windows
On 1 September 2026 the patron portal certificate has seventeen days left and is flagged for renewal within the three-week window; the catalogue has thirty-seven days, the staff wiki thirty and the e-book site sixty-two. The e-book site's 397-day lifetime marks it as manually managed, an outlier now that the others use ninety days or less. Priya checks why the portal's automated renewal has not yet run and finds that its ACME client starts at a third of lifetime remaining, about thirty days, but failed silently after a firewall change. She fixes the rule and adds an alert on renewal failures.
29.3 Routine rotation
Beyond certificates, Priya schedules routine rotation of backup and database keys yearly using envelope encryption, so only data keys are re-wrapped. Each rotation follows a runbook with checks and rollback, and is recorded in the inventory. She also tests restoring a backup encrypted under the previous key, because a rotation that makes old backups unreadable would be a disaster. Operations succeed when they are routine, documented and tested. She records each rotation in the inventory with its date, so future auditors can confirm that keys were changed on schedule and old backups remained readable.
Worked example
Priya finds the portal certificate flagged with seventeen days left because ACME renewal failed silently after a firewall change, fixes it with an alert, and schedules tested key rotation.
Synthetic case. Dates and certificates are invented; RFC 8555 is real.
Errors and limits
Automation fails silently without alerts. Rotation must keep old backups readable.
Exercises
- EX085 — Flagged certificate. Which certificate was flagged and with how many days left? Rubric: 3 = patron-portal, 17 days;; 2 = name;; 1 = wrong;; 0 = none.
- EX086 — Outlier lifetime. Why is the e-book site an outlier? Rubric: 3 = 397-day lifetime indicates manual management versus 90 days or less elsewhere;; 2 = long;; 1 = short;; 0 = none.
- EX087 — Rotation test. Why test restoring an old backup after rotation? Rubric: 3 = rotation must not make old backups unreadable;; 2 = readability;; 1 = not needed;; 0 = none.
Synthesis
Automated renewal with alerts and tested rotation make cryptographic operations routine rather than emergencies.
Continue studying — chapter 29 of 40
← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →