Challenge 1: Integrate TLS Certificate Issued by the OCI Certificates Service with Load Balancer

Task 1: Create and Configure a Virtual Cloud Network (VCN)

Step 1: Create the Virtual Cloud Network (VCN)

Log in to the OCI Console.

Navigate toNetworking>Virtual Cloud Networks.

ClickCreate Virtual Cloud Network.

SelectVCN with Internet Connectivity(to include an Internet Gateway by default).

Enter the following details:

Name: PBT-CERT-VCN-01

Compartment: Select your assigned compartment.

VCN CIDR Block: 10.0.0.0/16

Leave other settings as default (e.g., create a new public subnet and route table).

ClickCreate Virtual Cloud Network. Wait for the VCN to be created.

Step 2: Create Subnet 1 (Compute-Subnet-PBT-CERT)

In the VCN details page for PBT-CERT-VCN-01, clickSubnetsunderResources.

ClickCreate Subnet.

Enter the following details:

Name: Compute-Subnet-PBT-CERT

Subnet Type: Regional

CIDR Block: 10.0.1.0/24

Route Table: Select the default route table created with the VCN.

Subnet Access: Public Subnet (to allow internet access).

DNS Resolution: Enabled.

ClickCreate.

Step 3: Create Subnet 2 (LB-Subnet-PBT-CERT-SNET-02)

In the VCN details page, clickSubnetsunderResources.

ClickCreate Subnet.

Enter the following details:

Name: LB-Subnet-PBT-CERT-SNET-02

Subnet Type: Regional

CIDR Block: 10.0.2.0/24

Route Table: Select the default route table created with the VCN.

Subnet Access: Public Subnet (to allow internet access for the load balancer).

DNS Resolution: Enabled.

ClickCreate.

Step 4: Verify Internet Gateway

In the VCN details page, underResources, clickInternet Gateways.

Ensure an Internet Gateway is listed and attached to PBT-CERT-VCN-01. If not created, clickCreate Internet Gateway, name it (e.g., PBT-CERT-IGW), and attach it.

Step 5: Configure Route Table

In the VCN details page, underResources, clickRoute Tables.

Select the default route table or create a new one named PBT-CERT-RT-01.

ClickAdd Route Rule. 4 -Destination CIDR Block: 0.0.0.0/0

Target Type: Internet Gateway

Target: Select the Internet Gateway created (e.g., PBT-CERT-IGW).

ClickAdd Route Ruleand save.

Step 6: Create Security List for Subnet 1 (Compute-Subnet-PBT-CERT)

In the VCN details page, underResources, clickSecurity Lists.

ClickCreate Security List.

Enter the following:

Name: PBT-CERT-CS-SL-01

Compartment: Your assigned compartment.

Add the following ingress rule:

Source CIDR: 0.0.0.0/0 (allow from any source, adjust as per security needs)

IP Protocol: TCP

Source Port Range: All

Destination Port Range: 22 (for SSH)

Allows: Traffic

ClickCreate.

Step 7: Create Security List for Subnet 2 (LB-Subnet-PBT-CERT-SNET-02)

In the VCN details page, underResources, clickSecurity Lists.

ClickCreate Security List.

Enter the following:

Name: PBT-CERT-LB-SL-01

Compartment: Your assigned compartment.

Add the following ingress rule:

Source CIDR: 0.0.0.0/0 (allow from any source, adjust as per security needs)

IP Protocol: TCP

Source Port Range: All

Destination Port Range: 443 (for HTTPS)

Allows: Traffic

ClickCreate.

Step 8: Retrieve and Enter VCN OCID

Go to the VCN details page for PBT-CERT-VCN-01.

Copy theOCIDfrom the VCN information section.

Enter the OCID in the provided text box.

To provision a compute instance named IAD-SP-PBT-1-VM-01 in the IAD-SP-PBT-PUBSNET-01 public subnet with the specified configuration (Oracle Linux 8 image, VM Standard A1 Flex shape), follow these steps based on the Oracle Cloud Infrastructure (OCI) Compute documentation.

Step-by-Step Solution for Task 5: Provision a Compute Instance

Log in to the OCI Console:

Use your OCI credentials to log in to the OCI Console (https://console.us-ashburn-1.oraclecloud.com ).

Ensure you have access to the assigned compartment.

Navigate to Compute Instances:

From the OCI Console, click the navigation menu (hamburger icon) on the top left.

UnderCompute, selectInstances.

Create a New Compute Instance:

Click theCreate Instancebutton.

Configure the Instance Details:

Name:Enter IAD-SP-PBT-1-VM-01.

Compartment:Select the assigned compartment.

Placement:Choose the availability domain (e.g., AD-1) based on your region’s availability.

Select the Image:

UnderImage and Shape, clickChange Image.

SelectOracle Linux 8from the platform images list.

ClickSelect Image.

Choose the Shape:

ClickChange Shape.

SelectVM Standardcategory.

ChooseA1 Flexfrom the shape options.

Configure the OCPUs (e.g., 1 OCPU) and memory (e.g., 6 GB) as needed for A1 Flex, then clickSelect Shape.

Configure Networking:

UnderNetworking, ensure theVirtual Cloud Networkis set to IAD-SP-PBT-VCN-01.

Set theSubnetto IAD-SP-PBT-PUBSNET-01 (public subnet with CIDR 10.0.1.0/24).

EnableAssign a public IPv4 addressto allow external connectivity.

Leave the default security list or assign a custom one if configured previously.

Set Up SSH Access:

UnderAdd SSH Keys, either:

Upload your public SSH key file, or

Paste your public SSH key manually.

This ensures you can access the instance via SSH.

Launch the Instance:

ClickCreateto provision the compute instance.

Wait for the instance to reach theRunningstate (this may take a few minutes).

Note the Instance OCID:

Once the instance is running, go to the instance details page for IAD-SP-PBT-1-VM-01.

Copy theOCIDdisplayed (e.g., ocid1.instance.oc1..).

OCID of the Created Compute Instance

Enter the OCID of the created compute instance (IAD-SP-PBT-1-VM-01) into the text box. The exact OCID will be available after Step 9 (e.g., ocid1.instance.oc1..).

Notes

Ensure the security zone IAD_SAP-PBT-CSZ-01 and its associated recipe IAD-SP-PBT-CSP-01 allow compute instance creation in the public subnet (10.0.1.0/24).

Verify network connectivity by testing SSH access using the public IP assigned to the instance.

Task 3: Create a Master Encryption Key

Step 1: Access the OCI Vault

Log in to the OCI Console.

Navigate toIdentity & Security>Vault.

Select the root compartment.

Locate and click on the vault named PBI_Vault_SP.

Step 2: Create the Master Encryption Key

In the PBI_Vault_SP vault details page, underResources, clickKeys.

ClickCreate Key.

Enter the following details:

Name: Replace with your username (e.g., if your username is 99008677-lab.user01, remove special characters like - and . to get 99008677labuser01, then use PBT-CERT-MEK-0199008677labuser01).

Key Shape: SelectRSAwith4096 bits.

Protection Mode: SelectHSM(Hardware Security Module) if available, orSoftwareif HSM is not required (based on vault capabilities).

Compartment: Ensure it’s set to the root compartment (where PBI_Vault_SP resides).

Leave other settings (e.g., key usage) as default unless specified.

ClickCreate Keyand wait for the key to be generated.

Step 3: Retrieve and Enter the OCID

After the key is created, go to theKeyssection under PBI_Vault_SP.

Click on the key named PBT-CERT-MEK-01 (e.g., PBT-CERT-MEK-0199008677labuser01).

Copy theOCID(a long string starting with ocid1.key., unique to your tenancy) from the key details page.

Enter the copied OCID exactly as it appears into the provided text box.

Task 4: Create a Certificate Authority (CA)

Create a certificate authority, where:

CA name: PBT-CERT-CA-01-

For example, if your username is 99008677-lab.user01, then the certificate authority name should be PBT-CERT-CA-01990086771abuser01

Ensure you eliminate special characters from the user name.

Common name: PBT-CERT-OCICA-01

Master Encryption Key: PBT-CERT-MEK-01 (created in the previous task)

Answer: See the solution below in Explanation.

Task 4: Create a Certificate Authority (CA)

Step 1: Access the OCI Vault

Log in to the OCI Console.

Navigate toIdentity & Security>Vault.

Select the root compartment.

Locate and click on the vault named PBI_Vault_SP.

Step 2: Create the Certificate Authority

In the PBI_Vault_SP vault details page, underResources, clickCertificate Authorities.

ClickCreate Certificate Authority.

Enter the following details:

Name: Replace with your username (e.g., if your username is 99008677-lab.user01, remove special characters like - and . to get 99008677labuser01, then use PBT-CERT-CA-0199008677labuser01).

Common Name: Enter PBT-CERT-OCICA-01.

Master Encryption Key: Select the PBT-CERT-MEK-01 key created in Task 3 (e.g., PBT-CERT-MEK-0199008677labuser01).

Subject: Leave as default or adjust (e.g., Organization, Country) if required by your setup.

Validity Period: Set as needed (e.g., 10 years), or use the default.

Compartment: Ensure it’s set to the root compartment.

ClickCreate Certificate Authorityand wait for the CA to be provisioned.

Step 3: Verify the Certificate Authority

After creation, go to theCertificate Authoritiessection under PBI_Vault_SP.

Confirm the CA PBT-CERT-CA-01 (e.g., PBT-CERT-CA-0199008677labuser01) is listed and its status is active.