diff --git a/.gitignore b/.gitignore
index c6b279fa..92ae0e5e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,4 @@ node_modules/
 .venv/
 .DS_Store
 *.swp
+labs/lab11/waf/waf-logs/
diff --git a/labs/lab11/results/cipher.txt b/labs/lab11/results/cipher.txt
new file mode 100644
index 00000000..4c46aafd
--- /dev/null
+++ b/labs/lab11/results/cipher.txt
@@ -0,0 +1,3 @@
+New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
+    Cipher    : TLS_AES_256_GCM_SHA384
+    Cipher    : TLS_AES_256_GCM_SHA384
diff --git a/labs/lab11/results/headers.txt b/labs/lab11/results/headers.txt
new file mode 100644
index 00000000..424d519e
--- /dev/null
+++ b/labs/lab11/results/headers.txt
@@ -0,0 +1,22 @@
+HTTP/1.1 200 OK
+Server: nginx
+Date: Fri, 10 Jul 2026 08:42:04 GMT
+Content-Type: text/html; charset=UTF-8
+Content-Length: 9903
+Connection: keep-alive
+Feature-Policy: payment 'self'
+X-Recruiting: /#/jobs
+Accept-Ranges: bytes
+Cache-Control: public, max-age=0
+Last-Modified: Fri, 10 Jul 2026 08:38:56 GMT
+ETag: W/"26af-19f4b2e096b"
+Vary: Accept-Encoding
+Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
+X-Frame-Options: DENY
+X-Content-Type-Options: nosniff
+Referrer-Policy: strict-origin-when-cross-origin
+Permissions-Policy: camera=(), geolocation=(), microphone=()
+Cross-Origin-Opener-Policy: same-origin
+Cross-Origin-Resource-Policy: same-origin
+Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'
+
diff --git a/labs/lab11/results/http-redirect.txt b/labs/lab11/results/http-redirect.txt
new file mode 100644
index 00000000..e9fb8590
--- /dev/null
+++ b/labs/lab11/results/http-redirect.txt
@@ -0,0 +1,15 @@
+HTTP/1.1 308 Permanent Redirect
+Server: nginx
+Date: Fri, 10 Jul 2026 08:41:37 GMT
+Content-Type: text/html
+Content-Length: 164
+Connection: keep-alive
+Location: https://localhost/
+X-Frame-Options: DENY
+X-Content-Type-Options: nosniff
+Referrer-Policy: strict-origin-when-cross-origin
+Permissions-Policy: camera=(), geolocation=(), microphone=()
+Cross-Origin-Opener-Policy: same-origin
+Cross-Origin-Resource-Policy: same-origin
+Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'
+
diff --git a/labs/lab11/results/ratelimit.txt b/labs/lab11/results/ratelimit.txt
new file mode 100644
index 00000000..48f12840
--- /dev/null
+++ b/labs/lab11/results/ratelimit.txt
@@ -0,0 +1,2 @@
+     54 429
+      6 500
diff --git a/labs/lab11/results/timeout.txt b/labs/lab11/results/timeout.txt
new file mode 100644
index 00000000..bd8ea16e
--- /dev/null
+++ b/labs/lab11/results/timeout.txt
@@ -0,0 +1,8 @@
+Connecting to ::1
+Can't use SSL_get_servername
+depth=0 CN=juice.local
+verify error:num=18:self-signed certificate
+verify return:1
+depth=0 CN=juice.local
+verify return:1
+A8330000:error:0A000126:SSL routines::unexpected eof while reading:../openssl-3.5.5/ssl/record/rec_layer_s3.c:698:
diff --git a/labs/lab11/results/tls13.txt b/labs/lab11/results/tls13.txt
new file mode 100644
index 00000000..3d0b7eb0
--- /dev/null
+++ b/labs/lab11/results/tls13.txt
@@ -0,0 +1,8 @@
+Connecting to ::1
+Can't use SSL_get_servername
+depth=0 CN=juice.local
+verify error:num=18:self-signed certificate
+CONNECTION ESTABLISHED
+Protocol version: TLSv1.3
+Ciphersuite: TLS_AES_256_GCM_SHA384
+Peer certificate: CN=juice.local
diff --git a/labs/lab11/results/waf-audit.txt b/labs/lab11/results/waf-audit.txt
new file mode 100644
index 00000000..e8980f0b
--- /dev/null
+++ b/labs/lab11/results/waf-audit.txt
@@ -0,0 +1,9 @@
+{"transaction":{"client_ip":"127.0.0.1","time_stamp":"Fri Jul 10 09:00:26 2026","server_id":"c96835f14eb6f49b91a82df9e69c29ce2a1206a4","client_port":47222,"host_ip":"127.0.0.1","host_port":8443,"unique_id":"178367402620.995940","is_interrupted":false,"request":{"method":"GET","http_version":"2.0","hostname":"localhost","uri":"/healthz","headers":{"user-agent":"healthcheck","accept":"*/*","host":"localhost:8443"}},"response":{"body":"OK","http_code":200,"headers":{"Server":"nginx\u0000","Date":"Fri, 10 Jul 2026 09:00:26 GMT","Content-Length":"2","Content-Type":"application/octet-stream","Content-Type":"text/plain","Connection":"close"}},"producer":{"modsecurity":"ModSecurity v3.0.16 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.10\""]},"messages":[]}}
+{"transaction":{"client_ip":"127.0.0.1","time_stamp":"Fri Jul 10 09:00:56 2026","server_id":"c96835f14eb6f49b91a82df9e69c29ce2a1206a4","client_port":36772,"host_ip":"127.0.0.1","host_port":8443,"unique_id":"178367405662.529850","is_interrupted":false,"request":{"method":"GET","http_version":"2.0","hostname":"localhost","uri":"/healthz","headers":{"user-agent":"healthcheck","accept":"*/*","host":"localhost:8443"}},"response":{"body":"OK","http_code":200,"headers":{"Server":"nginx\u0000","Date":"Fri, 10 Jul 2026 09:00:56 GMT","Content-Length":"2","Content-Type":"application/octet-stream","Content-Type":"text/plain","Connection":"close"}},"producer":{"modsecurity":"ModSecurity v3.0.16 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.10\""]},"messages":[]}}
+{"transaction":{"client_ip":"127.0.0.1","time_stamp":"Fri Jul 10 09:01:27 2026","server_id":"c96835f14eb6f49b91a82df9e69c29ce2a1206a4","client_port":47686,"host_ip":"127.0.0.1","host_port":8443,"unique_id":"178367408768.607175","is_interrupted":false,"request":{"method":"GET","http_version":"2.0","hostname":"localhost","uri":"/healthz","headers":{"user-agent":"healthcheck","accept":"*/*","host":"localhost:8443"}},"response":{"body":"OK","http_code":200,"headers":{"Server":"nginx\u0000","Date":"Fri, 10 Jul 2026 09:01:27 GMT","Content-Length":"2","Content-Type":"application/octet-stream","Content-Type":"text/plain","Connection":"close"}},"producer":{"modsecurity":"ModSecurity v3.0.16 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.10\""]},"messages":[]}}
+{"transaction":{"client_ip":"172.20.0.1","time_stamp":"Fri Jul 10 09:01:43 2026","server_id":"c96835f14eb6f49b91a82df9e69c29ce2a1206a4","client_port":46280,"host_ip":"172.20.0.4","host_port":8080,"unique_id":"178367410380.402071","is_interrupted":true,"request":{"method":"GET","http_version":"1.1","hostname":"localhost","uri":"/rest/products/search?q='%20OR%201=1--","headers":{"Host":"localhost:8081","User-Agent":"curl/8.18.0","Accept":"*/*"}},"response":{"body":"<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n","http_code":403,"headers":{"Server":"nginx\u0000","Date":"Fri, 10 Jul 2026 09:01:43 GMT","Content-Length":"146","Content-Type":"text/plain","Access-Control-Allow-Origin":"*","Connection":"keep-alive","Access-Control-Max-Age":"3600","Access-Control-Allow-Methods":"GET, POST, PUT, DELETE, OPTIONS","Access-Control-Allow-Headers":"*"}},"producer":{"modsecurity":"ModSecurity v3.0.16 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.10\""]},"messages":[{"message":"SQL Injection Attack Detected via libinjection","details":{"match":"detected SQLi using libinjection.","reference":"v28,10","ruleId":"942100","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"46","data":"Matched Data: s&1c found within ARGS:q: ' OR 1=1--","severity":"2","ver":"OWASP_CRS/3.3.10","rev":"","tags":["application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/1","OWASP_CRS","capec/1000/152/248/66","PCI/6.5.2"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Score: 5)","details":{"match":"Matched \"Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' )","reference":"","ruleId":"949110","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"81","data":"","severity":"2","ver":"OWASP_CRS/3.3.10","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-generic"],"maturity":"0","accuracy":"0"}}]}}
+{"transaction":{"client_ip":"127.0.0.1","time_stamp":"Fri Jul 10 09:01:57 2026","server_id":"c96835f14eb6f49b91a82df9e69c29ce2a1206a4","client_port":50166,"host_ip":"127.0.0.1","host_port":8443,"unique_id":"178367411746.611460","is_interrupted":false,"request":{"method":"GET","http_version":"2.0","hostname":"localhost","uri":"/healthz","headers":{"user-agent":"healthcheck","accept":"*/*","host":"localhost:8443"}},"response":{"body":"OK","http_code":200,"headers":{"Server":"nginx\u0000","Date":"Fri, 10 Jul 2026 09:01:57 GMT","Content-Length":"2","Content-Type":"application/octet-stream","Content-Type":"text/plain","Connection":"close"}},"producer":{"modsecurity":"ModSecurity v3.0.16 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.10\""]},"messages":[]}}
+{"transaction":{"client_ip":"127.0.0.1","time_stamp":"Fri Jul 10 09:02:27 2026","server_id":"c96835f14eb6f49b91a82df9e69c29ce2a1206a4","client_port":42676,"host_ip":"127.0.0.1","host_port":8443,"unique_id":"178367414721.647263","is_interrupted":false,"request":{"method":"GET","http_version":"2.0","hostname":"localhost","uri":"/healthz","headers":{"user-agent":"healthcheck","accept":"*/*","host":"localhost:8443"}},"response":{"body":"OK","http_code":200,"headers":{"Server":"nginx\u0000","Date":"Fri, 10 Jul 2026 09:02:27 GMT","Content-Length":"2","Content-Type":"application/octet-stream","Content-Type":"text/plain","Connection":"close"}},"producer":{"modsecurity":"ModSecurity v3.0.16 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.10\""]},"messages":[]}}
+{"transaction":{"client_ip":"127.0.0.1","time_stamp":"Fri Jul 10 09:02:57 2026","server_id":"c96835f14eb6f49b91a82df9e69c29ce2a1206a4","client_port":46892,"host_ip":"127.0.0.1","host_port":8443,"unique_id":"178367417732.279455","is_interrupted":false,"request":{"method":"GET","http_version":"2.0","hostname":"localhost","uri":"/healthz","headers":{"user-agent":"healthcheck","accept":"*/*","host":"localhost:8443"}},"response":{"body":"OK","http_code":200,"headers":{"Server":"nginx\u0000","Date":"Fri, 10 Jul 2026 09:02:57 GMT","Content-Length":"2","Content-Type":"application/octet-stream","Content-Type":"text/plain","Connection":"close"}},"producer":{"modsecurity":"ModSecurity v3.0.16 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.10\""]},"messages":[]}}
+{"transaction":{"client_ip":"127.0.0.1","time_stamp":"Fri Jul 10 09:03:27 2026","server_id":"c96835f14eb6f49b91a82df9e69c29ce2a1206a4","client_port":46066,"host_ip":"127.0.0.1","host_port":8443,"unique_id":"17836742074.571046","is_interrupted":false,"request":{"method":"GET","http_version":"2.0","hostname":"localhost","uri":"/healthz","headers":{"user-agent":"healthcheck","accept":"*/*","host":"localhost:8443"}},"response":{"body":"OK","http_code":200,"headers":{"Server":"nginx\u0000","Date":"Fri, 10 Jul 2026 09:03:27 GMT","Content-Length":"2","Content-Type":"application/octet-stream","Content-Type":"text/plain","Connection":"close"}},"producer":{"modsecurity":"ModSecurity v3.0.16 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.10\""]},"messages":[]}}
+{"transaction":{"client_ip":"127.0.0.1","time_stamp":"Fri Jul 10 09:03:57 2026","server_id":"c96835f14eb6f49b91a82df9e69c29ce2a1206a4","client_port":39670,"host_ip":"127.0.0.1","host_port":8443,"unique_id":"178367423788.827231","is_interrupted":false,"request":{"method":"GET","http_version":"2.0","hostname":"localhost","uri":"/healthz","headers":{"user-agent":"healthcheck","accept":"*/*","host":"localhost:8443"}},"response":{"body":"OK","http_code":200,"headers":{"Server":"nginx\u0000","Date":"Fri, 10 Jul 2026 09:03:57 GMT","Content-Length":"2","Content-Type":"application/octet-stream","Content-Type":"text/plain","Connection":"close"}},"producer":{"modsecurity":"ModSecurity v3.0.16 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.10\""]},"messages":[]}}
diff --git a/labs/lab11/reverse-proxy/nginx.conf b/labs/lab11/reverse-proxy/nginx.conf
index dff91b26..a9275749 100644
--- a/labs/lab11/reverse-proxy/nginx.conf
+++ b/labs/lab11/reverse-proxy/nginx.conf
@@ -31,6 +31,9 @@ http {
   limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;
   limit_req_status 429;
 
+  # Connection limit zone (Task 2)
+  limit_conn_zone $binary_remote_addr zone=conn:10m;
+
   map $http_upgrade $connection_upgrade { default upgrade; '' close; }
 
   # Common proxy settings
@@ -83,15 +86,30 @@ http {
     http2 on;
     server_name _;
 
+    # Connection limit (Task 2)
+    limit_conn conn 50;
+
+    # Fail-closed timeouts (client-side, Task 2)
+    client_body_timeout 10s;
+    client_header_timeout 10s;
+
     ssl_certificate     /etc/nginx/certs/localhost.crt;
     ssl_certificate_key /etc/nginx/certs/localhost.key;
-    ssl_session_timeout 10m;
+    ssl_session_timeout 1d;
     ssl_session_cache   shared:SSL:10m;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:EECDH+AESGCM:EDH+AESGCM";
-    ssl_prefer_server_ciphers on;
+    ssl_session_tickets off;
+
+    # TLS 1.3 only, per Task 1 requirement
+    ssl_protocols TLSv1.3;
+    ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
+    ssl_ecdh_curve X25519:secp384r1;
+    # TLS 1.3 negotiates ciphersuites independently of this directive, but Task 1
+    # explicitly asks for it to be off (TLS 1.2 server-preference logic doesn't apply here).
+    ssl_prefer_server_ciphers off;
+
     ssl_stapling off;
-    # If using a publicly-trusted certificate, you may enable OCSP stapling:
+    # OCSP stapling requires a publicly-trusted CA-issued cert; our self-signed
+    # lab cert has no OCSP responder to query, so stapling is documentation-only here.
     # ssl_stapling on;
     # ssl_stapling_verify on;
     # resolver 1.1.1.1 8.8.8.8 valid=300s;
@@ -99,13 +117,11 @@ http {
     # ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
 
     client_max_body_size 2m;
-    client_body_timeout 10s;
-    client_header_timeout 10s;
     keepalive_timeout 10s;
     send_timeout 10s;
 
     # Security headers (include HSTS here only)
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
     add_header X-Frame-Options "DENY" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -118,10 +134,14 @@ http {
       limit_req zone=login burst=5 nodelay;
       limit_req_log_level warn;
       proxy_pass http://juice;
+      proxy_connect_timeout 5s;
+      proxy_read_timeout 30s;
     }
 
     location / {
       proxy_pass http://juice;
+      proxy_connect_timeout 5s;
+      proxy_read_timeout 30s;
     }
   }
 }
diff --git a/labs/lab11/waf/docker-compose.override.yml b/labs/lab11/waf/docker-compose.override.yml
new file mode 100644
index 00000000..57e5463d
--- /dev/null
+++ b/labs/lab11/waf/docker-compose.override.yml
@@ -0,0 +1,16 @@
+services:
+  waf:
+    image: owasp/modsecurity-crs:nginx-alpine
+    restart: unless-stopped
+    depends_on:
+      - juice
+    environment:
+      BACKEND: "http://juice:3000"
+      PARANOIA: "1"
+      MODSEC_RULE_ENGINE: "On"
+      MODSEC_AUDIT_ENGINE: "On"
+      MODSEC_AUDIT_LOG: "/var/log/modsecurity/audit.log"
+    ports:
+      - "8081:8080"
+    volumes:
+      - ./waf-logs:/var/log/modsecurity:rw
diff --git a/submissions/lab11.md b/submissions/lab11.md
new file mode 100644
index 00000000..534f2e45
--- /dev/null
+++ b/submissions/lab11.md
@@ -0,0 +1,158 @@
+# Lab 11 — BONUS — Submission
+
+## Task 1: TLS + Security Headers
+
+### nginx.conf (SSL + header sections)
+```nginx
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+  http2 on;
+  server_name _;
+
+  limit_conn conn 50;
+  client_body_timeout 10s;
+  client_header_timeout 10s;
+
+  ssl_certificate     /etc/nginx/certs/localhost.crt;
+  ssl_certificate_key /etc/nginx/certs/localhost.key;
+  ssl_session_timeout 1d;
+  ssl_session_cache   shared:SSL:10m;
+  ssl_session_tickets off;
+
+  ssl_protocols TLSv1.3;
+  ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
+  ssl_ecdh_curve X25519:secp384r1;
+  ssl_prefer_server_ciphers off;
+
+  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+  add_header X-Frame-Options "DENY" always;
+  add_header X-Content-Type-Options "nosniff" always;
+  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+  add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+  add_header Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" always;
+}
+```
+
+### A. HTTPS redirect proof
+```
+HTTP/1.1 308 Permanent Redirect
+Location: https://localhost/
+```
+
+### B. TLS 1.3 proof
+```
+CONNECTION ESTABLISHED
+Protocol version: TLSv1.3
+Ciphersuite: TLS_AES_256_GCM_SHA384
+Peer certificate: CN=juice.local
+```
+
+### C. Security headers proof (all 6 present)
+```
+Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
+X-Frame-Options: DENY
+X-Content-Type-Options: nosniff
+Referrer-Policy: strict-origin-when-cross-origin
+Permissions-Policy: camera=(), geolocation=(), microphone=()
+Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'
+```
+
+### What each header defends against
+- **HSTS**: forces the browser to always use HTTPS for this domain, even if the user types `http://` or clicks an old HTTP link, preventing SSL-stripping downgrade attacks.
+- **X-Content-Type-Options: nosniff**: stops the browser from guessing ("sniffing") a file's MIME type, blocking attacks where a malicious file disguised as an image is executed as a script.
+- **X-Frame-Options: DENY**: prevents the page from being embedded in an `<iframe>` on another site, defending against clickjacking.
+- **Referrer-Policy**: limits how much of the current URL is leaked to external sites via the `Referer` header when a user clicks an outbound link, reducing information disclosure.
+- **Permissions-Policy**: explicitly disables browser features (camera, microphone, geolocation) the site doesn't need, shrinking the attack surface if the page is ever compromised by XSS.
+- **Content-Security-Policy**: restricts which sources scripts, styles, and images can load from, mitigating the impact of an XSS injection even if one slips through.
+
+---
+
+## Task 2: Production Posture
+
+### Rate limit proof
+| HTTP code | Count out of 60 |
+|-----------|----------------:|
+| 429 | 54 |
+| 500 | 6 |
+
+The 500s are expected — these are GET requests to a login endpoint that expects a POST body; the point of this test is that the rate limiter itself engaged (54/60 blocked with 429), not the semantic correctness of unrelated requests that got through.
+
+### Timeout enforced
+```
+Connecting to ::1
+depth=0 CN=juice.local
+verify error:num=18:self-signed certificate
+A8330000:error:0A000126:SSL routines::unexpected eof while reading
+```
+An incomplete request (missing the terminating blank line HTTP requires) was sent, then the client waited 15s before doing anything else. Nginx's `client_header_timeout 10s` closed the connection before the 15s elapsed — the abrupt "unexpected eof" is the client observing the server-initiated close.
+
+### Cipher hardening
+```
+New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
+Cipher    : TLS_AES_256_GCM_SHA384
+Peer Temp Key: X25519, 253 bits
+```
+
+### Cert rotation runbook (7 steps)
+1. **Detect expiry**: Monitor certificate `notAfter` dates via an automated check (e.g. `openssl x509 -enddate -noout` run daily by a cron job or a monitoring tool like Prometheus blackbox exporter) that alerts 30 days before expiry.
+2. **Order new cert**: Request a new certificate from the CA (Let's Encrypt via certbot in production, or an internal CA) using the same CSR parameters (CN, SANs) as the current cert.
+3. **Validate**: Verify the new cert's chain, expiry date, and that the private key matches the public cert (`openssl x509 -noout -modulus | md5sum` vs `openssl rsa -noout -modulus | md5sum`) before deploying.
+4. **Atomic swap**: Write the new `.crt`/`.key` files to a staging path, then atomically rename/symlink them into the path Nginx reads from, so there's no window where a half-written file is served.
+5. **Verify**: Reload Nginx (`nginx -s reload`, not a full restart, to avoid dropping connections), then re-run the TLS verification commands (`openssl s_client`) against the live endpoint to confirm the new cert is being served.
+6. **Rollback plan**: Keep the previous cert/key pair backed up until the new one is confirmed working in production traffic for at least one full day; if anything breaks, atomically swap back the old files and reload.
+7. **Audit**: Log the rotation event (old serial number, new serial number, timestamp, operator) to the change-management system for compliance traceability.
+
+### What OCSP stapling buys you
+OCSP stapling lets the server proactively attach a signed, time-stamped "this certificate is not revoked" response from the CA to the TLS handshake, so the client doesn't have to make its own separate call to the CA's OCSP responder — this is faster and doesn't leak the client's browsing activity to the CA. It's not meaningful for our self-signed lab cert because there is no CA issuing OCSP responses for it in the first place; stapling only has something to staple when a real, publicly-trusted CA is in the chain, which is why this directive is commented out and documentation-only here.
+
+---
+
+## Bonus: WAF Sidecar with OWASP CRS
+
+### Setup choice
+- WAF used: **ModSecurity v3** (via the official `owasp/modsecurity-crs:nginx-alpine` image — Nginx + ModSecurity v3 connector + OWASP CRS bundled together, avoiding a manual module compile)
+- OWASP CRS version: **3.3.10**
+- Paranoia level: **1**
+
+### Attack payload sent
+`GET /rest/products/search?q=' OR 1=1--` (URL-encoded)
+
+### Before WAF (Nginx alone, Task 1/2 stack on :443)
+```
+no-waf: HTTP 500
+```
+The request reached Juice Shop unmodified; the app itself errored trying to process the malformed query, but nothing blocked it upstream.
+
+### After WAF (ModSecurity sidecar on :8081)
+```
+with-waf: HTTP 403
+```
+
+### Audit log excerpt (the rules that fired)
+```json
+{"messages":[
+  {
+    "message":"SQL Injection Attack Detected via libinjection",
+    "details":{
+      "match":"detected SQLi using libinjection.",
+      "ruleId":"942100",
+      "file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf",
+      "data":"Matched Data: s&1c found within ARGS:q: ' OR 1=1--",
+      "tags":["attack-sqli","paranoia-level/1","OWASP_CRS"]
+    }
+  },
+  {
+    "message":"Inbound Anomaly Score Exceeded (Total Score: 5)",
+    "details":{
+      "match":"Matched \"Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' )",
+      "ruleId":"949110",
+      "file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"
+    }
+  }
+]}
+```
+Rule ID: **942100** — OWASP CRS rule name: **SQL Injection Attack Detected via libinjection** (the detection rule that flagged the payload); the actual 403 block is issued by the separate blocking-evaluation rule **949110** once the accumulated anomaly score crosses the paranoia-level-1 threshold — this two-stage detect-then-score-then-block design is CRS's core mechanism.
+
+### Tradeoff analysis
+A WAF catches attack **patterns** at the network edge, independent of the application's own code — Semgrep only sees what's in the source it scanned, ZAP only probes what its scan config covers, and the Lab 7 Conftest gate only checks Kubernetes manifest hardening, so none of them stop a malicious request from ever reaching a vulnerable endpoint at runtime the way the WAF just did. The cost is real: paranoia level 1 already needed a real payload to trigger, and pushing to paranoia 2-4 for stricter coverage sharply increases false positives on legitimate traffic (URLs with quotes, JSON bodies with SQL-like keywords, etc.), which means someone has to actively tune exceptions or the WAF becomes an availability risk of its own; it also adds an extra network hop, another TLS termination point, and another piece of config/certs to keep in sync. A WAF is a poor fit in front of an internal-only service with a small, trusted client set (the ops overhead outweighs the benefit), or as a substitute for fixing the underlying vulnerable code — it's a compensating control, not a replacement for SAST/dependency scanning that would actually eliminate the SQL injection at the source.