skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-ssl-certificate-lifecycle-management

Automate X.509 certificate generation, validation, monitoring, renewal, and revocation using Python and ACME.

954|172|Updated Mar 13, 2026
Search Tags:#certificates#SSL#TLS#pki#acme#x509#ocsp
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-ssl-certificate-lifecycle-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-ssl-certificate-lifecycle-management
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/cryptography/performing-ssl-certificate-lifecycle-management
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-ssl-certificate-lifecycle-management

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Expired, misconfigured, or untracked SSL/TLS certificates cause outages and security incidents. This Skill provides a structured methodology for managing the full certificate lifecycle so nothing expires silently and every chain validates correctly.

Core Features & Use Cases

  • CSR and Certificate Handling: Generate PKCS#10 Certificate Signing Requests and parse X.509 certificates to extract fields like SANs, signature algorithms, and expiry dates.
  • Expiration Monitoring and Renewal: Track certificate expiry across infrastructure and automate renewal through the ACME protocol (e.g., Let's Encrypt) before the 30-day threshold.
  • Revocation and Chain Validation: Verify full certificate chains with openssl, detect revoked certificates via CRL and OCSP, and maintain an inventory of all deployed certificates.
  • Use Case: A security engineer auditing 50 domains uses this Skill to enumerate every certificate, flag an expired intermediate in one chain, confirm SAN coverage, and verify OCSP stapling is enabled on all servers.

Quick Start

Use this skill to audit the SSL certificates on my domains, check chain validity and expiration dates, and verify revocation status via OCSP.

Frequently Asked Questions about performing-ssl-certificate-lifecycle-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate SSL certificate renewal with ACME?▼

Use an ACME client such as Certbot or a Python ACME library to request and renew certificates from Let's Encrypt. Configure renewal to trigger well before expiry, typically at the 30-day threshold, and verify the new chain deploys correctly.

How to check SSL certificate expiration with openssl?▼

Run openssl x509 -enddate -noout on the certificate file to print its expiry date. For live servers, use openssl s_client -connect host:443 -showcerts to inspect the served chain, and check intermediates as well as the leaf.

Why does my SSL certificate fail validation on some clients?▼

The most common cause is an incomplete chain where the server sends the leaf but omits the intermediate certificate. Verify with openssl verify -untrusted chain.pem leaf.pem returning OK, and confirm the hostname appears in subjectAltName rather than only the CN field.

How do I check if a certificate has been revoked?▼

Query the certificate's OCSP responder or download its CRL to check revocation status. Enable OCSP stapling on servers so clients receive a signed revocation proof, and never assume a certificate is valid without checking.

What key types should I use for new TLS certificates?▼

Prefer ECDSA P-256 keys for better performance, or RSA with at least 2048 bits. Reject any certificate using SHA-1 signatures, and confirm the Signature Algorithm field when parsing certificates.

Related Skills

Explore More Software Engineering Skills→
Muath2000Muath2000

attack-surface-analyst

Discover and monitor internet-facing assets for external attack surface management.

Community
Advanced
KaiserWhoLearnsKaiserWhoLearns

ssl-certs

Diagnose SSL certificate issues and provide remediation steps using OpenSSL.

Community
Intermediate
GhostPWNGhostPWN
4

Cryptographic Analysis & Assessment

Analyze cryptographic configurations and implementations for security weaknesses.

Official
Advanced
salvo-rssalvo-rs
20

salvo-tls-acme

Automates ACME certificate provisioning and renewal for Rust Salvo apps via Rustls and HTTP-01/TLS-ALPN-01 challenges.

Official
Advanced