Chapter 14 — Cryptography and trust services: automation

Chapter 14 — Cryptography and trust services: automation

Lesson map

Lesson 14 published. Map, example, EX053.

flowchart TD
  N0["Learning outcomes"]
  N1["14.1 ACME renewal"]
  N2["14.2 Planning rotation"]
  N3["Lab — Rotation planner"]
  N4["14.3 Safe failure"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX053"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["14.1 ACME renewal"]
  N2["14.2 Planning rotation"]
  N3["Lab — Rotation planner"]
  N4["14.3 Safe failure"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX053"]

[Learning outcomes]
    |
    v
[14.1 ACME renewal]
    |
    v
[14.2 Planning rotation]
    |
    v
[Lab — Rotation planner]
    |
    v
[14.3 Safe failure]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX053]

Learning outcomes

You will (1) explain how ACME automates certificate issuance and renewal; (2) plan key rotation from an inventory; (3) build safe failure handling into automation.

14.1 ACME renewal

Manual renewals caused Lumen's last two outages, so Priya moves public certificates to ACME, the protocol in RFC 8555 used by many certificate authorities. An ACME client on each server proves control of the domain, requests a certificate and renews automatically, typically when about a third of the lifetime remains. Tomás learns that automation changes the risk rather than removing it: renewals still fail when DNS changes, firewalls block validation or the client's account key is lost. Each automated renewal needs monitoring, and the expiry report from chapter 7 remains the safety net that catches silent failures.

14.2 Planning rotation

Not every key has a protocol like ACME. SSH keys, HMAC secrets and the internal root follow cryptoperiods set by policy, guided by NIST SP 800-57 Part 1. Tomás writes a script that reads a synthetic key inventory with creation dates and maximum ages, and lists which keys are due for rotation. The script plans; it does not rotate, because each rotation needs coordination with partners or the payment processor. The lab output below shows three keys due within thirty days, one of them already overdue, sorted so the overdue key is handled first.

Lab — Rotation planner

# Plan (not perform) key rotation from a synthetic inventory.
import datetime
TODAY = datetime.date(2026, 3, 1)
keys = [("sftp-partner-a ssh", "2025-06-01", 365), ("sftp-partner-b ssh", "2024-12-25", 390),
        ("payment-callback hmac", "2025-09-10", 180), ("portal tls key", "2025-12-01", 398),
        ("depot-wifi root", "2021-01-15", 3650), ("backup encryption key", "2025-03-20", 365)]
due = []
for name, made, max_age in keys:
    left = max_age - (TODAY - datetime.date.fromisoformat(made)).days
    if left <= 30: due.append((left, name))
for left, name in sorted(due):
    print(f"{name:24} {'OVERDUE by ' + str(-left) if left < 0 else str(left) + ' days left'}")

Run with python3 lab_rotation.py. Verified output:

sftp-partner-b ssh       OVERDUE by 41
payment-callback hmac    8 days left
backup encryption key    19 days left

14.3 Safe failure

Automation that fails quietly is worse than none, because people stop checking. Tomás designs the renewal job to alert the on-call technician when a renewal fails twice, to keep the old certificate in place until the new one is verified, and to log every step without printing private keys. He also adds a dry-run mode for testing. Priya adds a rule that any automation able to change keys must run under its own service account with only the permissions it needs, so a bug cannot overwrite unrelated keys or read secrets it should not see.

Worked example

Tomás runs the rotation lab, schedules the overdue partner SSH key first, and adds failure alerts and a dry-run mode to the ACME renewal job.

Synthetic case. Keys, ages and partners are synthetic; RFC 8555 and SP 800-57 Part 1 are real.

Errors and limits

Automated renewal still depends on DNS, firewalls and account keys. Cryptoperiods are policy decisions, not universal constants.

Exercises

• EX053 — ACME role. What does an ACME client automate? Rubric: 3 = proving domain control, requesting and renewing certificates;; 2 = renewal;; 1 = manual;; 0 = none.
• EX054 — Overdue key. In the lab, which key was overdue and by how many days? Rubric: 3 = sftp-partner-b ssh key, overdue by 41 days;; 2 = key only;; 1 = vague;; 0 = none.
• EX055 — Plan not rotate. Why does the script only plan rotations? Rubric: 3 = rotations need coordination with partners and providers;; 2 = coordination;; 1 = lazy;; 0 = none.
• EX056 — Keep old cert. Why keep the old certificate until the new one is verified? Rubric: 3 = so a failed renewal does not cause an outage;; 2 = avoid outage;; 1 = no reason;; 0 = none.

Synthesis

Automation should renew and plan rotation reliably, fail loudly and run with the least privilege needed.

Continue studying — chapter 14 of 18

← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →