Optional Practice Lab 4 of 4 · 25 min

Short-Lived Identity End to End

Practice reasoning about attestation, rotation margins, the one safe use of InsecureSkipVerify, per-destination clients, and the availability cost of credentials that expire in a minute.

Covers Lesson 11 · Lesson 12 · Lesson 13 · Lesson 14

What you will practice

Explain how far expiry substitutes for revocation, and where it does not.
Trace how a workload receives a credential without holding one.
Calculate a safe rotation margin.
Judge when disabling built-in verification is defensible and when it is a bug.

Step 1 of 7

Pass with 80% · unlimited retries

0% correct

Replace revocation with expiry

Why does a certificate that lives sixty seconds remove the everyday need for a revocation list?

It expires long before a revocation notice could realistically be distributed and honored.Short certificates cannot be stolen.It is not signed by a CA, so there is nothing to revoke.It is stored in memory, and memory cannot be read by an attacker.