Chapter 19 — Cryptography and trust services: monitoring
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 What to monitor"]
N2["Lab — Failure-rate alert"]
N3["19.2 Reading the alert"]
N4["19.3 Responding to alerts"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 What to monitor"]
N2["Lab — Failure-rate alert"]
N3["19.2 Reading the alert"]
N4["19.3 Responding to alerts"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 What to monitor]
|
v
[Lab — Failure-rate alert]
|
v
[19.2 Reading the alert]
|
v
[19.3 Responding to alerts]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) choose metrics for TLS and certificate health; (2) set alert thresholds that avoid noise; (3) respond to alerts with runbooks.
19.1 What to monitor
Rosa sets up monitoring for trust services: days until each certificate expires, ACME renewal successes and failures, TLS handshake failure rates on the gateway, webhook verification failures and HSM availability. Each metric has an owner and a runbook. She focuses on signals that predict problems, such as renewal failures, rather than only measuring outages after they happen. Monitoring is how the council learns of a problem before citizens do. Before setting thresholds she records two weeks of baseline values, so alerts reflect what is unusual for the council rather than numbers copied from elsewhere. She sends alerts to the on-call rota, never to personal inboxes that go unread on leave.
Lab — Failure-rate alert
"""Flag hours where TLS failure rate exceeds 2% for three consecutive hours (synthetic gateway counts)."""
HOURS = [(1200, 6), (1350, 9), (1500, 41), (1480, 44), (1420, 39), (1300, 12), (1250, 7)] # (handshakes, failures)
def main():
rates = [f / h for h, f in HOURS]
for i, r in enumerate(rates):
print(f"hour {i}: {100 * r:.2f}%")
run = 0
for i, r in enumerate(rates):
run = run + 1 if r > 0.02 else 0
if run == 3:
print(f"ALERT at hour {i} (3 consecutive hours above 2%)")
if __name__ == "__main__":
main()
Run with python3 lab_monitor.py. Verified output:
hour 0: 0.50%
hour 1: 0.67%
hour 2: 2.73%
hour 3: 2.97%
hour 4: 2.75%
hour 5: 0.92%
hour 6: 0.56%
ALERT at hour 4 (3 consecutive hours above 2%)
19.2 Reading the alert
The lab computes hourly TLS failure rates at the gateway. Normal hours sit below one percent. Hours 2, 3 and 4 rise to 2.73, 2.97 and 2.75 percent, and the rule, more than two percent for three consecutive hours, fires at hour 4. Requiring three hours avoids alerting on a brief spike. Rosa notes the trade-off: a citizen-facing certificate expiry would justify a faster alert, so expiry gets its own direct check thirty and seven days ahead rather than waiting for failures to rise. She also checks that the alert clears once rates return below the threshold, so stale alerts do not pile up.
19.3 Responding to alerts
Each alert links to a runbook. For a failure-rate alert, the runbook says to check the gateway log summary from Chapter 9, identify the dominant reason code and host, check recent changes and escalate if a certificate or configuration is wrong. Rosa practises the runbook on the synthetic spike and finds the cause in the scenario's change log: a configuration push removed a cipher suite needed by an older payment terminal. She also records alert volumes monthly and tunes thresholds that never lead to action.
Worked example
Rosa's monitoring fires a failure-rate alert at hour 4 after three hours above two percent, and her runbook traces it to a configuration push.
Synthetic case. Counts and causes are invented.
Errors and limits
Thresholds without baselines create noise or miss problems. Monitoring failures, not just outages, catches silent issues.
Exercises
- EX055 — Monitored signals. List four signals Rosa monitors. Rubric: 3 = four of expiry days, renewal results, handshake failure rate, webhook failures, HSM availability;; 2 = three;; 1 = one;; 0 = none.
- EX056 — Alert hour. When did the lab alert fire and why? Rubric: 3 = hour 4, after three consecutive hours above two percent;; 2 = hour;; 1 = wrong;; 0 = none.
- EX057 — Spike cause. What caused the synthetic spike? Rubric: 3 = configuration push removed a cipher suite needed by an older payment terminal;; 2 = cause;; 1 = vague;; 0 = none.
Synthesis
Monitoring predictive signals with tuned thresholds and runbooks lets operators fix trust problems before citizens notice.
Continue studying — chapter 19 of 30
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →