Chapter 7 — Cryptography and trust services: data and telemetry
Lesson map
Lesson 07 published. Map, example, EX025.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Useful data sources"]
N2["7.2 Expiry from inventory"]
N3["Lab — Certificate expiry report"]
N4["7.3 Keeping secrets out of logs"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX025"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Useful data sources"]
N2["7.2 Expiry from inventory"]
N3["Lab — Certificate expiry report"]
N4["7.3 Keeping secrets out of logs"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX025"]
[Learning outcomes]
|
v
[7.1 Useful data sources]
|
v
[7.2 Expiry from inventory]
|
v
[Lab — Certificate expiry report]
|
v
[7.3 Keeping secrets out of logs]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX025]
Learning outcomes
You will (1) choose data sources for monitoring cryptographic health; (2) compute certificate expiry from an inventory; (3) avoid logging secrets.
7.1 Useful data sources
Tomás lists where cryptographic facts can be observed. Server configurations show which TLS versions and certificates are deployed. Handshake logs on the load balancer record negotiated versions and failures. Certificate transparency logs, defined in RFC 6962, publicly list certificates issued for Lumen's domains, which helps detect unexpected issuance. The inventory spreadsheet records owners and expiry dates. Each source answers a different question, and none is complete alone: configuration says what should happen, logs say what did happen, and transparency logs show what certificate authorities issued for Lumen's names, whether or not Lumen asked for them.
7.2 Expiry from inventory
Expired certificates cause most of the outages Priya has seen. She asks Tomás to compute days remaining for every certificate in the inventory and sort by urgency. He writes a short script that reads a synthetic CSV, compares each notAfter date with a fixed review date and labels each row renew now, plan, or fine. Using a fixed review date in the lab keeps the output reproducible; in production the script would use the current date. The lab below shows the result for five synthetic certificates, including one that has already expired.
Lab — Certificate expiry report
# Synthetic certificate inventory; fixed review date for reproducible output.
import csv, io, datetime
REVIEW = datetime.date(2026, 3, 1)
data = """host,not_after,owner
track.lumen.example,2026-03-20,web-team
sftp.lumen.example,2026-07-30,ops
depot-wifi-ca,2031-01-15,ops
staging.lumen.example,2026-02-17,web-team
api.lumen.example,2026-04-10,web-team
"""
rows = []
for r in csv.DictReader(io.StringIO(data)):
d = (datetime.date.fromisoformat(r["not_after"]) - REVIEW).days
label = "EXPIRED" if d < 0 else "renew now" if d <= 30 else "plan" if d <= 60 else "fine"
rows.append((d, r["host"], r["owner"], label))
for d, h, o, l in sorted(rows):
print(f"{h:24} {d:5d} days {o:9} {l}")
Run with python3 lab_expiry.py. Verified output:
staging.lumen.example -12 days web-team EXPIRED
track.lumen.example 19 days web-team renew now
api.lumen.example 40 days web-team plan
sftp.lumen.example 151 days ops fine
depot-wifi-ca 1781 days ops fine
7.3 Keeping secrets out of logs
Telemetry can leak what it measures. A debug setting on the portal once logged full HTTP headers, including session cookies and an API key, into a file readable by the whole operations team. Tomás learns to check log formats before enabling them, to mask tokens so only a few characters remain, and to keep TLS key-logging features, which write session secrets for debugging, switched off in production. Logs are copied to many places, such as backups and analytics tools, so a secret written once can be very hard to remove completely.
Worked example
Tomás runs the expiry lab, finds one expired certificate on the old staging host, and opens a ticket that also removes a header-logging debug flag.
Synthetic case. Inventory rows, hosts and dates are synthetic; RFC 6962 is real.
Errors and limits
Inventories drift from reality; confirm expiry against the live endpoint. Transparency logs cover publicly trusted certificates, not internal ones.
Exercises
- EX025 — Three sources. Which source shows certificates a CA issued for Lumen even if Lumen did not request them? Rubric: 3 = certificate transparency logs;; 2 = names CT;; 1 = names config;; 0 = none.
- EX026 — Expired row. In the lab, which certificate had already expired and by how many days? Rubric: 3 = staging.lumen.example, expired 12 days before the review date;; 2 = host only;; 1 = vague;; 0 = none.
- EX027 — Fixed review date. Why does the lab use a fixed review date? Rubric: 3 = so the output is reproducible; production uses today;; 2 = reproducible;; 1 = no reason;; 0 = none.
- EX028 — Debug header logging. What went wrong with the portal's debug logging? Rubric: 3 = it logged session cookies and an API key into a widely readable file;; 2 = mentions secrets;; 1 = vague;; 0 = none.
Synthesis
Telemetry should reveal cryptographic health such as expiry and failures without itself becoming a source of leaked secrets.
Continue studying — chapter 07 of 18
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →