[1r444444]

Complete Lab 11 edge-hardening tasks and the OWASP CRS WAF bonus. Nginx accepts TLS 1.2/1.3, restricts TLS 1.3 to AES-GCM, adds all six security headers, and applies per-address connection limits plus login-only rate limiting, including case/trailing-slash route variants.

Validation on Docker Desktop:

• testssl.sh: TLS 1.0/1.1 not offered; TLS 1.2/1.3 offered. OpenSSL negotiates AES-256-GCM and receives handshake alert 40 for TLS 1.3 ChaCha20.
• Live Python assertions: 308 redirect; six headers on 200/401/413/429; six 401s then eight 429s; unrelated requests remain 200; connection 21 rejected; incomplete body times out after 10 seconds with a logged 408.
• Certificate rotation under 100 fresh HTTPS requests: 100 HTTP 200, zero failures; new served serial verified.
• Identical SQLi: plain proxy 500 from Juice Shop versus WAF 403, with real CRS 942100/949110 audit evidence. False-positive hunt reproduces legitimate whoami blocked by 932260 and documents scoped tuning and DetectionOnly-first rollout.
• Nginx syntax checks for both proxies, Compose validation, diff whitespace checks and Gitleaks passed. Keys/certificates and raw logs are excluded.

The report in submissions/lab11.md includes commands, recorded evidence, CSP/OCSP explanations, certificate rotation runbook, bypass analysis and a final acceptance matrix. Compared lab11 changes and reports from public PRs #1874, #1875 and #1668 after the initial implementation; all results here come from this local run. Moodle submission awaits the author's final review.