Chapter 20 — Cryptography and trust services: troubleshooting
Lesson map
Lesson 20 published. Map, example, EX058.
flowchart TD
N0["Learning outcomes"]
N1["20.1 A method"]
N2["20.2 Common root causes"]
N3["20.3 Fixing root causes"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX058"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["20.1 A method"]
N2["20.2 Common root causes"]
N3["20.3 Fixing root causes"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX058"]
[Learning outcomes]
|
v
[20.1 A method]
|
v
[20.2 Common root causes]
|
v
[20.3 Fixing root causes]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX058]
Learning outcomes
You will (1) troubleshoot certificate and TLS problems systematically; (2) use evidence rather than guesses; (3) fix root causes, not just symptoms.
20.1 A method
Rosa adopts a troubleshooting method: define the symptom precisely, collect evidence, form one hypothesis at a time, test it, fix and verify, then record. For a ticket saying "staff can't reach the wiki", she first asks which staff, which devices and what error. The error is "unknown certificate authority" on new laptops only. Evidence narrows the problem quickly: the new laptop image lacks the council's internal root certificate. Guessing, such as restarting the wiki server, would have wasted time. She tests one change at a time, so each result can be attributed to a single cause.
20.2 Common root causes
Rosa compiles root causes from past tickets: missing intermediates on servers; internal roots missing from new images; clocks wrong on devices, making valid certificates appear not yet valid; old clients lacking TLS 1.2 support; certificates missing a host name; and expired certificates renewed but not reloaded by the web server. The last one is subtle: the new certificate sits on disk, but the server still uses the old one in memory until reload. She adds reload verification to the renewal runbook.
20.3 Fixing root causes
For the wiki ticket, Rosa installs the internal root through device management for affected laptops, but also fixes the laptop image so future devices include it, and adds a test to the image build. For the reload issue, she configures renewal hooks to reload services and checks the served certificate's expiry after renewal. Fixing root causes prevents repeats and frees time. She records each case in a knowledge base with symptom, evidence, cause and fix. Each knowledge base entry is tagged with the affected service, so the next person searching finds it quickly.
Worked example
Rosa traces an unknown-CA error to a laptop image missing the internal root, fixes the image and adds post-renewal reload checks to prevent stale certificates in memory.
Synthetic case. Tickets are invented.
Errors and limits
Fixing symptoms leaves the cause to return. Multiple simultaneous changes make results impossible to interpret.
Exercises
- EX058 — Wiki diagnosis. What evidence revealed the wiki problem's cause? Rubric: 3 = unknown CA error on new laptops only; image lacked internal root;; 2 = evidence;; 1 = guess;; 0 = none.
- EX059 — Reload issue. Why can a renewed certificate still appear expired? Rubric: 3 = server keeps old certificate in memory until reloaded;; 2 = reload;; 1 = not renewed;; 0 = none.
- EX060 — Root-cause fix. What root-cause fix did Rosa apply for the wiki? Rubric: 3 = fixed laptop image and added image build test, besides installing root on affected devices;; 2 = image;; 1 = device only;; 0 = none.
Synthesis
Systematic, evidence-led troubleshooting finds root causes such as missing roots and unreloaded certificates and prevents repeats.
Continue studying — chapter 20 of 30
← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →