Chapter 12 — Contained laboratory I
Lesson map
Lesson 12 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["12.1 The contained lab"]
N2["12.2 Certificates in the lab"]
N3["Lab — Certificate expiry"]
N4["12.3 Reading the expiry list"]
N5["12.4 Lab discipline"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 The contained lab"]
N2["12.2 Certificates in the lab"]
N3["Lab — Certificate expiry"]
N4["12.3 Reading the expiry list"]
N5["12.4 Lab discipline"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX045"]
[Learning outcomes]
|
v
[12.1 The contained lab]
|
v
[12.2 Certificates in the lab]
|
v
[Lab — Certificate expiry]
|
v
[12.3 Reading the expiry list]
|
v
[12.4 Lab discipline]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) work safely in an isolated lab; (2) track certificate expiry; (3) plan renewals.
12.1 The contained lab
A contained lab is isolated from real networks, so mistakes cannot affect anyone. Amina's lab runs on an institute laptop with virtual machines on internal-only networks: a firewall, a VPN gateway, a server and two clients. All addresses, names and certificates are synthetic. Before each session she checks that the lab has no connection to the institute or Castleford networks. Working in a contained lab lets her practise configuration, failure and recovery freely. Snapshots let her return to a known starting point in minutes, which keeps exercises comparable.
12.2 Certificates in the lab
Amina creates a small internal certificate authority in the lab and issues certificates for the lab VPN gateway and web server, with short lifetimes so she can observe expiry. She watches what happens when a certificate expires: the VPN client refuses to connect and the browser shows a warning. Seeing these failures in the lab helps her explain to Castleford staff why expiry tracking matters and what symptoms to expect if it is missed. She records each symptom with a screenshot for the runbook.
Lab — Certificate expiry
"""Days to expiry for synthetic certificates on a fixed reference date (stdlib only)."""
from datetime import date
ref = date(2026, 3, 1)
certs = {"vpn-gw": date(2026, 3, 20), "webmail": date(2026, 9, 1), "intranet": date(2026, 4, 15),
"wifi-radius": date(2026, 2, 20), "booking": date(2027, 1, 10), "printer-ui": date(2026, 4, 25)}
for n, d in sorted(certs.items(), key=lambda x: x[1]):
days = (d - ref).days
s = "EXPIRED" if days < 0 else "renew now" if days < 30 else "plan renewal" if days < 60 else "ok"
print(f"{n:12}{d} {days:5} days {s}")
Run with python3 lab_certs.py. Verified output:
wifi-radius 2026-02-20 -9 days EXPIRED
vpn-gw 2026-03-20 19 days renew now
intranet 2026-04-15 45 days plan renewal
printer-ui 2026-04-25 55 days plan renewal
webmail 2026-09-01 184 days ok
booking 2027-01-10 315 days ok
12.3 Reading the expiry list
On the synthetic reference date, the wireless authentication certificate has already expired by nine days, which would stop staff connecting to staff wireless. The VPN gateway certificate expires in nineteen days and needs renewal now. Two more, the intranet and printer interface, fall within sixty days and need planned renewal. Two are fine. Amina orders the actions by impact: wireless authentication first, then the VPN, then the others, and assigns an owner and date to each. The list is rerun weekly so new certificates and dates are always included.
12.4 Lab discipline
Amina keeps a lab notebook recording what she configured, what she tested and what happened. She resets the lab from a clean snapshot at the start of each exercise so results are not affected by leftovers. When she discovers something useful, such as the exact client error shown on certificate expiry, she adds it to a runbook draft for Castleford. Disciplined lab work produces knowledge that can be reused safely in the real environment. Her notebook also records failures and how she solved them.
Worked example
One certificate has expired, one needs renewal within nineteen days and two need planned renewal within sixty days.
Synthetic case. Lab and certificates are synthetic.
Errors and limits
Running labs connected to real networks risks affecting live systems.
Exercises
- EX045 — Expired certificate effect. What would the expired wireless authentication certificate cause? Rubric: 3 = staff unable to connect to staff wireless;; 2 = wireless failure;; 1 = vague;; 0 = none.
- EX046 — Renewal priority. Which certificate is renewed first, and why? Rubric: 3 = wireless authentication, already expired, highest impact;; 2 = wireless;; 1 = VPN;; 0 = none.
- EX047 — Planned renewals. How many certificates need planned renewal within sixty days? Rubric: 3 = two (intranet, printer-ui);; 2 = two;; 1 = four;; 0 = none.
- EX048 — Lab isolation check. What does Amina check before each lab session? Rubric: 3 = no connection to real networks;; 2 = isolation;; 1 = vague;; 0 = none.
Synthesis
A contained lab makes failures safe to observe and turns them into practical runbooks.
Continue studying — chapter 12 of 18
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →