◇ OpenCyber Academy
Technical · Chapter 12 · English

Chapter 12 — Contained laboratory I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Contained laboratory I

Lesson map

Lesson 12 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Isolation first"]
  N2["12.2 A throwaway lab root"]
  N3["12.3 Tearing down"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Isolation first"]
  N2["12.2 A throwaway lab root"]
  N3["12.3 Tearing down"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX045"]

[Learning outcomes]
    |
    v
[12.1 Isolation first]
    |
    v
[12.2 A throwaway lab root]
    |
    v
[12.3 Tearing down]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) set up an isolated lab for TLS and certificate work; (2) issue test certificates from a throwaway lab root; (3) tear the lab down so no test trust leaks into production.

12.1 Isolation first

Priya gives Tomás a virtual machine on an isolated network segment with no route to production and no access to real secrets. All hostnames end in .lab.lumen.example and resolve only inside the segment. Isolation lets him break things on purpose, such as serving an expired certificate or a wrong chain, without affecting customers. He writes the lab's boundaries at the top of his notebook: no real customer data, no production keys, no connections out to partners. If a test ever needs production-like data, he uses synthetic data generated for the purpose.

12.2 A throwaway lab root

Using openssl in the virtual machine, Tomás creates a lab root key and certificate, an intermediate and two server certificates, one valid and one deliberately expired. He installs the lab root only in the lab client's trust store, never on his laptop or in a shared image. He then runs s_client against each server and records the results: the valid server verifies with result 0, the expired one fails with a clear error and a server configured without the intermediate fails to build a chain. Seeing each error in a safe place makes it recognisable later.

12.3 Tearing down

When the exercise ends, Tomás deletes the lab root private key, removes the root from the lab client's trust store and destroys the virtual machine snapshot. He writes a teardown record listing each item removed. Priya explains that forgotten lab roots are a real risk: a root installed for a test and left on a laptop lets anyone with its key intercept that laptop's traffic. A good lab ends with less trust installed than it started with, and the record proves it to the next technician who uses the environment.

Worked example

Tomás builds a lab root, intermediate and two servers, reproduces three handshake results and completes a teardown record removing the root and its key.

Synthetic case. Lab names and keys are synthetic and destroyed after use.

Errors and limits

Virtual isolation can fail through shared clipboards or bridged networks. Lab results may differ from production clients with other trust stores.

Exercises

Synthesis

A contained lab lets technicians reproduce failures safely and ends with all test trust removed and recorded.

Continue studying — chapter 12 of 18

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →