Issue short-lived certificates and survive an expiry

applied · 75 min · Objective 3.4

Task

Apply objective 3.4: run a small internal certificate authority with mutual TLS between two services, deliberately let a certificate expire, and then automate renewal so it cannot happen again.

Steps

  1. Create a local CA and issue certificates to two services. Configure mutual TLS and confirm each authenticates the other.
  2. Attempt a connection from a THIRD process with no certificate and capture the refusal in lab/mtls-deny.txt.
  3. Issue a certificate with a very short lifetime, let it expire, and capture the resulting failure in lab/cert-expiry.txt -- this is a self-inflicted availability incident, and seeing it is the point.
  4. Automate renewal so it happens well before expiry, and demonstrate a renewal occurring without downtime.
  5. Build lab/cert-inventory.csv as subject,issuer,expires,days_left,owner for every certificate in the lab, and write a check that exits non-zero on anything within a threshold. Run it.

Verify

grep -Eic 'certificate required|bad certificate|handshake|denied' lab/mtls-deny.txt
grep -Eic 'expired|certificate_expired|not valid' lab/cert-expiry.txt
awk -F, 'NR>1 {n++} END {print n" certificate(s) inventoried"}' lab/cert-inventory.csv
sh lab/cert-check.sh; echo "expiry check exit=$?"

A refusal for the uncertificated process, a captured expiry failure, every certificate inventoried, and the check exiting non-zero when one is close to expiry. Short lifetimes are operationally EASIER than long ones because they make renewal automation mandatory and therefore reliable.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.