Trust-Store Update Drill
Practice updating every trust store — so a real CA incident is routine
Run a timed drill that updates every trust store in your estate — browsers, OS, runtimes, containers, appliances — and verifies each one, so the next real CA compromise is a checklist, not a scramble.
Installala in 3 passaggi
Nessuna registrazione. Nessuno strumento da riga di comando. Scegli la tua AI, copia una riga e incollala.
Preferisci fare da te? Acquista la skill ($4.99), scarica lo ZIP dalla conferma d'acquisto, decomprimilo nella cartella mostrata sopra e riavvia la sessione della tua AI — stesso risultato. L'hai già acquistata? Il tuo assistente AI può scaricarla per te.
Cosa contiene
Un file SKILL.md (la guida operativa) + un modello di partenza. Un'anteprima:
Trust-Store Update Drill
Why drill
When eMudhra's intermediates were compromised in October 2026, the browsers moved in hours: Chrome's CRLSet in about 100 minutes, Mozilla's OneCRL the same evening, Apple within two days, Microsoft within three. The long tail was everything else — Go programs, Python apps, Node services, container images, appliances — each with its own update path and its own way of silently failing. A drill finds those paths before an incident makes them urgent.
Workflow
- Pick a stand-in update (input: your store list -> output: a drill target).
Choose a real, low-risk update to practice with: a routine root bundle
refresh, a test CA removal, or a scheduled runtime upgrade. Never
practice on a live compromise the first time — the drill's job is to
teach the paths, not to add stress to a real incident. - Run the clock (input: the drill target -> output: timed results per store).
Update each store in the order your certificate inventory ranks them,
and time each one: browsers/OS, runtimes, containers (rebuild + redeploy),
appliances (vendor process). Record the command or click path for each.
A path nobody can reproduce from the notes is not a path. - Verify, don't assume (input: updated stores -> output: a verification line per store).
For each store, prove the update landed: check the bundle version or
hash, test a connection to a host that chains to a removed root (it
must fail), and test a known-good host (it must succeed). An update
with no verification is a hope, and hopes do not survive audits. - Find the frozen copies (input: verification failures -> output: a frozen-copy list).
The drill's real prize is the list of places that did not update:
libraries with bundled roots, golden images, offline appliances, vendor
firmware with no update path. Each frozen copy gets: an owner, a
workaround (pinning, proxying, isolation), and a replacement plan.
This list is the drill's main output — file it where the incident
responders will look. - Write the runbook (input: timed results + frozen list -> output: a one-page runbook).
The runbook fits on one page: order, commands, verification checks,
frozen copies and workarounds, and the escalation contact per store.
Re-run the drill after any runbook change and at least twice a year.
A runbook nobody has run is a guess.
Anteprima del modello
Trust-Store Drill Worksheet
1. Drill target
-
2. Timed results
3. Verification checks
- Removed-root host (must fail):
- Known-good host (must succeed):
4. Frozen copies
5. Runbook location
-
Il pacchetto della skill (SKILL.md + modello) è scritto in inglese.
