◇ OpenCyber Academy
Professional · Chapter 11 · English

Chapter 11 — Supervised laboratory

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Supervised laboratory

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Mirroring the service"]
  N2["11.2 Rehearsal and rollback"]
  N3["11.3 Closing the lab"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Mirroring the service"]
  N2["11.2 Rehearsal and rollback"]
  N3["11.3 Closing the lab"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Mirroring the service]
    |
    v
[11.2 Rehearsal and rollback]
    |
    v
[11.3 Closing the lab]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) set up a contained lab mirroring a client service; (2) rehearse a certificate renewal and rollback; (3) close the lab without leaving trust behind.

11.1 Mirroring the service

Before the agency renews the booking site's certificate on a new hosting platform, Marcus asks Dana to rehearse it in a contained lab. She builds an isolated virtual network with a web server copying the booking site's configuration, a throwaway lab certificate authority and a client machine that trusts only that lab root. No real keys, patient data or production names are used; hostnames end in .lab.copperleaf.example. Mirroring the configuration matters more than mirroring the content, because the renewal risks lie in file paths, chain order and server reload behaviour rather than in the web pages.

11.2 Rehearsal and rollback

Dana writes the steps: generate a new key, request a certificate from the lab authority, install the certificate with its intermediate, reload the server and test. She deliberately installs the chain in the wrong order once and sees the client fail, then fixes it. She also practises rollback: restoring the previous key and certificate from the backup copy and reloading. Timing each step shows the whole renewal takes twelve minutes, with two minutes of reload risk. The agency uses her tested steps and timings to plan a short maintenance window for the real renewal.

11.3 Closing the lab

When the rehearsal ends, Dana deletes the lab authority's private key, removes the lab root from the client, destroys the virtual machines and writes a closure note listing what was removed. Marcus explains why this matters: a lab root left on any machine lets whoever holds its key create certificates that machine trusts. The closure note also records lessons for the real change, such as checking chain order explicitly. A supervised lab is judged not only by what it taught but by whether it left anything risky behind.

Worked example

Dana rehearses the booking renewal in a mirrored lab, reproduces a chain-order failure, practises rollback and closes the lab with a removal note.

Synthetic case. Lab hosts, keys and timings are synthetic.

Errors and limits

Labs cannot reproduce every production difference, such as provider caching. A rehearsed rollback still depends on a current backup.

Exercises

Synthesis

Rehearsing changes in a contained lab reduces production risk, provided the lab is closed cleanly afterwards.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →