Chapter 1 — Research question and literature method
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Sharpening the question"]
N3["1.3 A documented search"]
N4["Lab — Screening funnel"]
N5["1.4 Reading the funnel"]
N6["1.5 Recording decisions"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Sharpening the question"]
N3["1.3 A documented search"]
N4["Lab — Screening funnel"]
N5["1.4 Reading the funnel"]
N6["1.5 Recording decisions"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 Sharpening the question]
|
v
[1.3 A documented search]
|
v
[Lab — Screening funnel]
|
v
[1.4 Reading the funnel]
|
v
[1.5 Recording decisions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) turn an operational pain into a researchable question about certificate lifecycles; (2) run a documented literature search with a screening funnel; (3) record why each source was kept or dropped.
1.1 The case
Felipe Arantes is a master's student at the fictional Coldwater Polytechnic, supervised by Dr. Ingrid Solberg. The fictional Briarwood Health Network runs about 1,400 TLS certificates across patient portals, laboratory systems and internal APIs. Last year several expired unnoticed, and clinicians briefly lost access to results. Some certificates renew automatically through an ACME client, as defined in RFC 8555, while others are renewed by hand from a spreadsheet. Felipe's working question is whether automated renewal is associated with fewer expiry incidents per certificate-year than manual renewal, and what else explains the incidents that still happen. All hosts and figures in this book are synthetic.
1.2 Sharpening the question
A good master's question is narrow enough to answer in a year and clear about its unit. Felipe defines an expiry incident as a user-visible failure caused by a certificate past its notAfter date, the validity field defined in RFC 5280. His unit is the certificate-year, so a service with many short-lived certificates is not unfairly counted. He writes one primary question about renewal mode and one secondary question about other causes, and he explicitly excludes revocation failures and algorithm weaknesses, which are real problems but would need different data. Dr. Solberg asks him to write the excluded topics down so the scope does not creep later.
1.3 A documented search
Felipe searches three academic databases plus the RFC index and NIST publications, using a written string combining certificate terms (certificate, X.509, TLS, PKI) with lifecycle terms (expiry, renewal, ACME, outage). He keeps the exact strings, dates and hit counts in a log so another student could rerun the search. Standards are searched separately because they rarely appear in academic indexes but define the vocabulary. The screening stages follow a common systematic-review pattern: remove duplicates, screen titles and abstracts against inclusion rules, read full texts, and keep only studies that report an outage or expiry outcome.
Lab — Screening funnel
"""Literature screening funnel for a synthetic review of certificate-lifecycle studies."""
STAGES = [("records found (3 databases + RFC/NIST search)", 412), ("after duplicate removal", 297),
("after title/abstract screen", 64), ("after full-text eligibility", 21),
("included with outage or expiry outcome", 9)]
def main():
prev = None
for name, n in STAGES:
drop = "" if prev is None else f" (-{prev - n})"
print(f"{n:>4} {name}{drop}")
prev = n
print(f"inclusion rate from deduplicated pool: {100 * STAGES[-1][1] / STAGES[1][1]:.1f}%")
if __name__ == "__main__":
main()
Run with python3 lab_screen.py. Verified output:
412 records found (3 databases + RFC/NIST search)
297 after duplicate removal (-115)
64 after title/abstract screen (-233)
21 after full-text eligibility (-43)
9 included with outage or expiry outcome (-12)
inclusion rate from deduplicated pool: 3.0%
1.4 Reading the funnel
The search finds 412 records, 297 remain after duplicates are removed, 64 pass title and abstract screening, 21 pass full-text eligibility and 9 report an expiry or outage outcome. Only 3.0 percent of the deduplicated pool is finally included, which is normal for a narrow question. The largest drop, 233 records, happens at title and abstract screening, mostly papers on certificate validation bugs rather than lifecycle management. Felipe reports every number, because a reader who sees only the nine included studies cannot judge whether relevant work was missed or excluded for weak reasons.
1.5 Recording decisions
For each full-text paper Felipe writes one line: citation, population, outcome measure, whether renewal was automated, and the reason for inclusion or exclusion. Twelve papers are dropped at full text, most because they measured certificate misissuance by authorities rather than expiry at operators. He separately records grey literature such as vendor outage reports, flagged as non-peer-reviewed, because they describe real failures but rarely state their methods. That log becomes an appendix of the dissertation and lets examiners test whether his conclusions follow from the evidence he actually read.
Worked example
Felipe writes the question with a certificate-year unit, logs the search strings, and reports a 412 to 9 funnel with reasons for every full-text exclusion.
Synthetic case. Coldwater, Briarwood and every host are invented; RFC 5280 and RFC 8555 are real.
Errors and limits
Searches miss work indexed under other words, and grey literature is uneven. A funnel shows diligence, not completeness, so state the search date and limits.
Exercises
- EX001 — Working question. State Felipe's primary question with its unit. Rubric: 3 = is ACME automated renewal associated with fewer expiry incidents per certificate-year than manual renewal;; 2 = without unit;; 1 = "fix expiry";; 0 = none.
- EX002 — Incident definition. How is an expiry incident defined, and which field marks expiry? Rubric: 3 = user-visible failure from a certificate past notAfter (RFC 5280);; 2 = definition without field;; 1 = any warning;; 0 = none.
- EX003 — Excluded topics. Which two topics did Felipe exclude and why? Rubric: 3 = revocation failures and algorithm weaknesses; need different data;; 2 = topics only;; 1 = one;; 0 = none.
- EX004 — Funnel numbers. Give the counts at each of the five stages. Rubric: 3 = 412, 297, 64, 21, 9;; 2 = four right;; 1 = ends only;; 0 = none.
- EX005 — Largest drop. Where was the biggest drop and what caused most of it? Rubric: 3 = title/abstract, 233 records, mostly validation-bug papers;; 2 = stage only;; 1 = duplicates;; 0 = none.
- EX006 — Full-text exclusions. Why were most full-text papers excluded? Rubric: 3 = they studied CA misissuance rather than operator expiry;; 2 = off-topic;; 1 = quality;; 0 = none.
- EX007 — Grey literature. How does Felipe handle vendor outage reports? Rubric: 3 = records them separately, flagged non-peer-reviewed, as methods are rarely stated;; 2 = flags them;; 1 = ignores;; 0 = none.
Synthesis
A narrow question with a fair unit, a replayable search and a full decision log are the foundation of a credible master's study.