Trace authenticated encryption from TLS negotiation to certificate lifecycle controls and VPN boundaries.
55 min 195 XPSkills: TLS negotiation, PKI validation, Tunnel assurance
Brief
At Halcyon Clinics, a laboratory integration stops accepting results at 02:00. Its certificate expired even though the network dashboard still shows TCP port 443 reachable. The operations lead proposes disabling certificate verification because 'the traffic is encrypted anyway'. Meanwhile a branch tunnel is green, but nobody can name where its encryption ends.
You must restore authenticated transport without converting an outage into an impersonation opportunity. Follow a handshake, distinguish a certificate from its private key, locate tunnel boundaries, and turn certificate discovery into an owned renewal control. Your evidence must show what a peer actually negotiated and validated, not merely what a configuration intended to allow.
Encryption without authenticated peer identity can protect a connection to the wrong party.
Handshake mechanics and cipher-suite boundaries
In a typical full TLS 1.2 handshake using ECDHE, the client offers versions and cipher suites; the server returns its choice, certificate and signed ephemeral key-exchange parameters. The client validates the certificate and signature, sends its ephemeral contribution, and both derive traffic keys before verifying Finished messages. The certificate key authenticates the exchange; the ephemeral shared secret supplies key material. A typical full handshake takes two round trips after TCP establishment, excluding application data and unusual negotiation paths.
TLS 1.3 normally includes a key share in ClientHello, allowing ServerHello to establish handshake keys immediately; the server's certificate, CertificateVerify and Finished follow under handshake encryption. A normal full handshake needs one round trip after TCP setup. TLS 1.3 cipher suites specify AEAD encryption and a hash, such as TLS_AES_128_GCM_SHA256; key-exchange groups and signature algorithms are negotiated separately. A TLS 1.2 suite such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 also identifies key exchange and authentication. TLS 1.3 removes static RSA key transport, not all RSA signatures.
Forward secrecy means later theft of a long-term authentication key does not by itself decrypt recorded sessions when ephemeral secrets were erased. TLS 1.2 can provide it through ephemeral DH or ECDHE; version alone is not enough. TLS 1.3 certificate-based exchanges provide it, but PSK-only resumption and replayable 0-RTT data require separate scrutiny. For transport controls, retain negotiated version, suite, group and validation results; ask whether the scan proves obsolete modes are rejected, rather than merely proving a modern mode succeeds.
Typical full handshakes differ in message timing, while authentication and key establishment remain distinct jobs.
X.509 is a signed identity claim, not automatic trust
An X.509 certificate binds a public key to identity claims under an issuer's signature. Inspect subject alternative names, serial number, issuer, validity interval, key usage and extended key usage. For results.clinic.example, a valid signature does not excuse a SAN containing only billing.clinic.example. The peer must prove possession of the corresponding private key during authentication; the certificate itself is public and may be distributed freely.
A server normally sends its leaf certificate and necessary intermediate certificates. The client builds a path to a root already trusted locally; sending a new self-signed root does not make it trusted. Validate issuer signatures, CA basic constraints, path restrictions, intended usage, name and current time. A root CA anchors policy and delegates issuance to intermediate CAs. An unexpired leaf can still fail because an intermediate expired or because the intended client lacks the required trust anchor.
Expiry ends the validity interval; revocation invalidates a certificate before that interval ends, for example after suspected private-key theft. CRLs publish signed lists and OCSP supplies signed status responses; stapling can deliver a status response through the server. Availability, freshness and soft-fail behavior affect whether revocation actually blocks a connection. An auditor should request negative tests for wrong names, untrusted issuers and revoked credentials plus the documented response to unavailable status services, not only a certificate screenshot.
Trust requires a valid path, an appropriate identity and usage, and proof of private-key possession.
Mutual TLS and the real boundaries of a tunnel
Ordinary server-authenticated TLS authenticates the server, not necessarily the client. With mutual TLS, the server requests a client certificate and verifies its chain, permitted client-auth usage and proof of possession. Both sides need deliberate trust stores and lifecycle handling. Map the validated client identity to an application authorization policy: a valid certificate does not automatically permit every API operation. Record denial tests for a trusted but unauthorized client as well as an untrusted one.
A site-to-site VPN connects network gateways; a remote-access VPN connects an individual endpoint to a gateway. IPsec tunnel mode wraps an entire inner IP packet in a new outer packet and can protect it with ESP. TLS-based VPNs protect traffic between tunnel endpoints using TLS-based mechanisms. Encapsulation alone, such as a plain GRE tunnel, adds an outer transport structure but does not encrypt the payload. Tunnel overhead reduces effective MTU and can cause fragmentation or stalled large transfers even when small probes work.
A branch-to-core tunnel protects only the segment between its gateways; traffic after decapsulation still needs appropriate protection. Split tunnelling routes only selected destinations into a remote-access tunnel, while full tunnelling routes general traffic through it, subject to explicit exceptions. Test route selection, peer authentication and the final application TLS hop. For segmentation and confidentiality controls, preserve tunnel endpoint diagrams, route tables and packet observations at both sides; ask exactly which party can see plaintext at each boundary.
Certificate inventory as a measurable lifecycle control
Discover certificates from network listeners and issuance records, then reconcile them against service ownership. Track endpoint and port, SANs, issuer, serial or fingerprint, notAfter, trust domain, owner, renewal method and deployment locations. One renewed certificate in the issuance system does not prove ten listeners serve it. Keep private keys out of the inventory; store only references to protected key custody and rotation procedures.
For Halcyon's local policy, scan daily, alert at 30 days remaining, and escalate unacknowledged alerts after 24 hours. After renewal, probe every listener and verify its new serial and validity, including failover nodes. A useful coverage metric is owned, monitored TLS listeners divided by all discovered in-scope TLS listeners; unknown owners count as failures rather than disappearing from the denominator. Short certificate lifetimes reduce exposure but demand reliable automation and recovery paths.
Treat compromise differently from routine renewal: contain access to the key, generate a new key pair, issue and deploy replacement credentials, request revocation of the old certificate and test relying-party behavior. Keep discovery timestamps, alert delivery, owner acknowledgement, deployment probes and revocation test results. An auditor can then trace a sampled listener from discovery to renewal and confirm that an overdue certificate cannot remain silently green.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The version-only assurance
Scenario sim+65 XP
Read the brief and answer both questions.
Incident brief
A service negotiates TLS 1.2 with ephemeral ECDHE and erases session secrets. Its owner says it has no protection against later authentication-key theft because only TLS 1.3 has that property. Another engineer claims a TLS 1.3 cipher-suite name must specify the certificate signature algorithm.
1.1Which property protects the recorded ECDHE sessions from later authentication-key theft? (two words)
1.2Which separately negotiated parameter category selects the certificate authentication signature scheme in TLS 1.3? (two words)
Task 2: The still-valid stolen credential
Scenario sim+65 XP
Read the brief and answer both questions.
Incident brief
A client private key was copied from an integration host. Its certificate expires in 80 days. The responder labels the fix 'wait for expiry' and says the endpoint already uses mutual TLS because the client validates the server's certificate. The server currently never requests client credentials.
Term bank, not all of these are right
revocationmutual TLSexpiryserver TLS
2.1Which certificate lifecycle action should invalidate the stolen credential before its scheduled end date? (one word)
2.2Which TLS authentication mode should be enabled so both peers authenticate with certificates? (two words)
Task 3: The encrypted wrapper claim
Scenario sim+65 XP
Read the brief and answer both questions.
Incident brief
Two branch gateways encapsulate whole IP packets in plain GRE without any additional protection. The network owner labels this an encrypted remote-access VPN because packets have new outer headers. A replacement design will establish an authenticated encrypted tunnel between the same two network gateways, not between individual employee devices and a gateway.
Term bank, not all of these are right
encapsulationsite-to-siteencryptionremote-access
3.1What mechanism added the outer headers without providing confidentiality? (one word)
3.2Which VPN deployment type describes the replacement's gateway-to-gateway relationship? (hyphenated term)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
The results listener accepts sensitive clinical messages. Operations proposes turning name checks off and treating the branch VPN as client authentication. The integration requires certificate authentication of both peers even when packets arrive through the tunnel.
Write the local control policy from the fixture. Use explicit booleans, version strings and numeric day counts. The inventory evidence must let a reviewer associate every discovered listener with an accountable person and a certificate end date.
Approved local requirements
listener: results.clinic.example:443
minimum protocol: TLS 1.2; retain compatible TLS 1.2 clients
peer validation: verify chain and hostname
caller authentication: client certificate required
inventory: daily discovery, owner and notAfter recorded
renewal alert: exactly 30 days before expiry
VPN: network transport only; not application identity
1
2
3
4
5
6
7
8
9
10
11
12
Checks
Minimum version preserves the approved compatibility floor
Six transport acceptance notes await approval. The change lead says anything encrypted can pass and that renewal is complete as soon as a CA issues a replacement.
Judge each note as written against authenticated transport and complete lifecycle evidence. Reject each defective note using its single primary reason.
Verdicts are accept or reject. Every rejection needs one reason code from: no-forward-secrecy | identity-bypass | tunnel-boundary | inventory-gap.
Acceptance notes and reason-code meanings
Reasons: no-forward-secrecy = static key transport claimed to provide forward secrecy; identity-bypass = trust or identity validation disabled; tunnel-boundary = protection claimed beyond tunnel endpoints; inventory-gap = issuance substituted for deployed-listener evidence.
SP-1 | TLS 1.2 uses static RSA key transport. Accept the claim that later server private-key theft cannot decrypt recorded sessions.
SP-2 | TLS 1.3 validates the server chain, SAN, time and usage. Negotiated parameters and wrong-name rejection tests are retained. Accept server authentication.
SP-3 | Both peers present certificates, but validation accepts any issuer and skips SAN checks for the server. Accept mutual authentication as secure.
SP-4 | A site-to-site tunnel ends at the core gateway. The application hop beyond it is plaintext. Accept the claim that the VPN encrypts that final hop too.
SP-5 | The CA issued a renewal. No listener has been probed, and neither owner nor expiry is tracked. Close the renewal control as complete.
SP-6 | Daily discovery includes standby listeners; records carry owners and expiry dates. Thirty-day alerts and post-deployment serial probes cover every listener. Accept lifecycle evidence.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · Networking Fundamentals
Network Security Architecture
Trace permitted flows, contain lateral movement, and prove firewall controls with configuration and operational evidence.
