Nomostatic Resign Lab Toolkit — R3, October 27, 2026

Read 02-lab-guide.md first. Extract this ZIP to /tmp/nomostatic-publication
on each Linux lab host, preserving tools/. Verify SHA256SUMS.txt there.

The policy workflow applies to compatible FTD models managed by cdFMC or
self-hosted FMC. Our 1210CE/FTD 10.1.0 build 160/cdFMC deployment is the
measured baseline, not a required hardware/management combination.

Ethernet1/5, Ethernet1/6, eth0 and the listed IPs are example assignments.
Choose appropriate interfaces and unused IPs in your environment. Map every
substitution consistently across objects, policies, NAT, routing and hosts.
Changing FTD physical port names alone does not change the host collectors
when zones, addresses and host NICs retain their original roles.

The stock tools intentionally pin our original topology. configure_client.py
changes only the public CA job/path/issuer and fingerprint. It does not
perform topology substitution. Read step 2 before changing IPs or host NICs:
adapt a separate copy including binds, allowlists, route/tuple/readiness
checks and dependent source pins/manifests. Keep original sources and fixed
synthetic fixture-body hashes. Run the same validation and cleanup gates.

Create fresh lab PKI with tools/create_lab_pki.sh on a trusted Linux admin
host; keep private/ outside downloads/evidence. Compare public CA pins
through an authenticated administrative channel. The preparation step sends
no requests and does not change system trust. Certificates remain verified.

This toolkit uses harmless fixtures and does not install vulnerable PHP.
The recorded outcomes belong to the original lab; alternative topologies
and platforms were not replayed during publication preparation. Read
VERIFICATION.md for actual checks and limits. No credentials, actual keys
or native traffic archives are included. Obtain the ZIP from the trusted
publication; a digest establishes byte integrity rather than publisher identity.
