Specify the laboratory transport guardrail

Objectives

The results listener accepts sensitive clinical messages. Operations proposes turning name checks off and treating the branch VPN as client authentication. The integration requires certificate authentication of both peers even when packets arrive through the tunnel.

Write the local control policy from the fixture. Use explicit booleans, version strings and numeric day counts. The inventory evidence must let a reviewer associate every discovered listener with an accountable person and a certificate end date.

listener: results.clinic.example:443
minimum protocol: TLS 1.2; retain compatible TLS 1.2 clients
peer validation: verify chain and hostname
caller authentication: client certificate required
inventory: daily discovery, owner and notAfter recorded
renewal alert: exactly 30 days before expiry
VPN: network transport only; not application identity

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the compatibility constraint

   Find the oldest protocol permitted by the approved requirement, not the newest protocol the listener could support. Represent it as text to avoid numeric ambiguity.

   Minimum version preserves the approved compatibility floor

2. Step 2

   Separate the identity checks

   Ask whether the issuer path is trusted and whether the certificate names this endpoint. Then consider which peer still needs to prove its identity.

   Both path and endpoint identity are verifiedThe caller must present a certificate

3. Step 3

   Make discovery actionable

   Translate the required scan frequency into the starter's unit. Choose inventory attributes that let a reviewer determine who must act and when the credential ceases to be valid.

   Discovery runs at the approved intervalInventory captures ownership and expiry

4. Step 4

   Work backward from expiry

   Use the local advance-warning interval, not a certificate lifetime or a guessed industry default.

   Renewal alert matches the local lead time

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.