Agent skill · security · jeremylongshore
detecting-ssl-cert-issues
Audit a target's TLS certificate beyond protocol/expiry — chain ordering, OCSP stapling, revocation status, Certificate Transparency presence, key-usage flags, and over-broad wildcards. Use when: TLS handshake already passes (skill #1 analyzing-tls-config cleared) but you suspect the cert posture is fragile. Auditors flag this during SOC2 readiness when a renewal slipped or an intermediate was rotated. Threshold: missing OCSP stapling on production, fewer than 2 SCTs in the cert, intermediate served out of order, key usage missing digitalSignature/keyEncipherment, revoked cert presented, or wildcard scope of 2-level (e.g., *.com is rejection; *.api.example.com is fine). Trigger with: "check cert revocation", "audit ocsp", "ct log check", "cert chain audit".
Why this skill is useful
Adds specific commands and checks for auditing TLS certificates that the AI wouldn't reliably generate on its own.
What it needs
Requires openssl, python3 installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Detecting SSL Certificate Issues Overview This skill is the second-level cert audit, run after analyzing-tls-config clears the protocol+cipher+expiry+hostname basics. It surfaces issues that don't break the handshake today but make the cert fragile or open to soft-bypass attacks: missing OCSP stapling forces clients to phone home to the CA (privacy + latency hit), missing Certificate Transparency SCTs are rejected by Chrome since 2018, an out-of-order chain confuses older clients, and over-broad wildcards expand the blast radius of any future key compromise. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- Revoked certificate presented CRITICAL OCSP responder says "revoked" RFC 6960 Missing or invalid OCSP staple HIGH No statusrequest response on production RFC 6066, CA/B BR Fewer than 2 SCTs embedded HIGH CT-policy violation (Chrome enforces) RFC 6962, CA/B Baseline Reqs Intermediate served out of RFC 5246 order MEDIUM Server sends root before leaf RFC 5246 §7.4.2 AIA extension missing MEDIUM No CA Issuers / OCSP URL in cert RFC 5280 §4.2.2.1 Over-broad wildcard HIGH Scope of 2-level or wider (e.g., .com) CA/B Baseline Reqs §3.2.2 Wildcard at apex SAN LOW .example.com without example.com RFC 6125 §6.4.3 Key Usage missing digitalSignature MEDIUM KU bit absent for TLS server cert RFC 5280 §4.2.1.3 Cert chain longer than 4 LOW Performance + trust expansion CA/B Baseline Reqs Prerequisites Python 3.9+ with cryptography library openssl CLI 1.1.1+ (for OCSP query + chain enumeration) Authorization for non-local targets (see references/AUTHORIZATION.md in skill #1 analyzing-tls-config for the canonical pattern) Instructions Step 1 — Confirm Authorization Active scan; ask the user verbatim: "Do you have authorization to perform TLS testing on this target? I need confirmation before proceeding." Step 2 — Run the scanner Options: Step 3 — Interpret findings CRITICAL/HIGH map to immediate action items; MEDIUM/LOW to backlog hardenin …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/detecting-ssl-cert-issues--2963df