About

Imported from jeremylongshore/tons-of-skills-marketplace (plugins/security/penetration-tester/skills/detecting-ssl-cert-issues/SKILL.md). Install upstream with npx skills add jeremylongshore/tons-of-skills-marketplace --skill detecting-ssl-cert-issues. Copyright stays with the author (MIT).

Detecting SSL Certificate Issues

Name: detecting-ssl-cert-issues
Author: jeremylongshore

Overview

This skill is the second-level cert audit, run after analyzing-tls-config clears the protocol+cipher+expiry+hostname basics. It surfaces issues that don't break the handshake today but make the cert fragile or open to soft-bypass attacks: missing OCSP stapling forces clients to phone home to the CA (privacy + latency hit), missing Certificate Transparency SCTs are rejected by Chrome since 2018, an out-of-order chain confuses older clients, and over-broad wildcards expand the blast radius of any future key compromise.

When the skill produces findings

Finding	Severity	Threshold	Affected control
Revoked certificate presented	CRITICAL	OCSP responder says "revoked"	RFC 6960
Missing or invalid OCSP staple	HIGH	No status_request response on production	RFC 6066, CA/B BR
Fewer than 2 SCTs embedded	HIGH	CT-policy violation (Chrome enforces)	RFC 6962, CA/B Baseline Reqs
Intermediate served out of RFC 5246 order	MEDIUM	Server sends root before leaf	RFC 5246 §7.4.2
AIA extension missing	MEDIUM	No CA Issuers / OCSP URL in cert	RFC 5280 §4.2.2.1
Over-broad wildcard	HIGH	Scope of 2-level or wider (e.g., *.com)	CA/B Baseline Reqs §3.2.2
Wildcard at apex SAN	LOW	*.example.com without example.com	RFC 6125 §6.4.3
Key Usage missing digitalSignature	MEDIUM	KU bit absent for TLS server cert	RFC 5280 §4.2.1.3
Cert chain longer than 4	LOW	Performance + trust expansion	CA/B Baseline Reqs

Prerequisites

Python 3.9+ with cryptography library
openssl CLI 1.1.1+ (for OCSP query + chain enumeration)
Authorization for non-local targets (see references/AUTHORIZATION.md in skill #1 analyzing-tls-config for the canonical pattern)

Instructions

Step 1 — Confirm Authorization

Active scan; ask the user verbatim:

"Do you have authorization to perform TLS testing on this target? I need confirmation before proceeding."

Step 2 — Run the scanner

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \
    https://target.example.com \
    --authorized

Options:

Usage: check_cert_chain.py URL [OPTIONS]

Options:
  --authorized       Attest authorization for non-local targets (required)
  --port PORT        Target port (default: 443)
  --output FILE      Write findings to FILE (default: stdout)
  --format FMT       json | jsonl | markdown (default: markdown)
  --min-severity SEV critical|high|medium|low|info (default: info)
  --timeout SECS     Per-probe timeout (default: 10)
  --skip-ocsp        Skip OCSP responder query (offline mode)

Step 3 — Interpret findings

CRITICAL/HIGH map to immediate action items; MEDIUM/LOW to backlog hardening. Cross-reference references/PLAYBOOK.md for OCSP stapling config snippets per server type.

Step 4 — Cross-skill chaining

After this skill, suggest checking-http-security-headers (#4) to verify HSTS preload status — HSTS preload depends on a clean cert chain to be effective.
For CI integration patterns, see references/PLAYBOOK.md § CI posture-monitoring.

Examples

Example 1 — OCSP stapling audit before adopting must-staple

User: "We're considering Must-Staple — what's our OCSP stapling posture look like across endpoints?"

for ENDPOINT in https://api.example.com https://app.example.com https://admin.example.com; do
  python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \
      "$ENDPOINT" --authorized --min-severity medium
done

If any endpoint reports "Missing OCSP staple" HIGH, adopting Must-Staple on that cert breaks it on next renewal until OCSP-stapling config lands. Pair with references/PLAYBOOK.md § OCSP stapling for nginx / Caddy / Apache config.

Example 2 — CT-log compliance check before public launch

User: "Pre-launch — does our cert have enough SCTs for Chrome to trust it?"

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \
    https://new-site.example.com --authorized

The scanner extracts embedded SCTs from the cert's CT extension. <2 SCTs → HIGH finding; Chrome's CT enforcement policy rejects the connection silently in HTTPS, leaving users with a generic error.

Example 3 — Wildcard scope audit

User: "An auditor flagged our wildcard cert as too broad."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \
    https://example.com --authorized --format json | jq '.[] | select(.title | contains("wildcard"))'

The JSON output captures the wildcard scope; pair with the auditor's request to either narrow the SAN list or move to per-service certs.

Output

JSON / JSONL / Markdown per lib/report.py. Exit codes: 0 clean, 1 high/critical, 2 error.

Error Handling

OCSP responder timeout → emitted as MEDIUM finding (not an error exit) with note to investigate responder availability.
CT log lookup unavailable → falls back to embedded-SCT parsing only; emits INFO note.
Untrusted cert → out of scope (skill #1 handles); this skill assumes the chain validates and looks at deeper posture.

Resources

references/THEORY.md — OCSP, CT, AIA, chain ordering, wildcard scope reasoning with RFC anchors
references/PLAYBOOK.md — OCSP stapling config per server type + CT-log compliance + AIA extension correctness
../analyzing-tls-config/references/AUTHORIZATION.md — canonical ROE template + 2-step gate (shared across all active-scan skills)

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/jeremylongshore-tons-of-skills-marketplace-detecting-ssl-d6ad1f/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

jeremylongshore-tons-of-skills-marketplace-detecting-ssl-d6ad1f.ocm.jsonjson

{
  "ocm": "1",
  "id": "jeremylongshore-tons-of-skills-marketplace-detecting-ssl-d6ad1f",
  "kind": "skill",
  "name": "detecting-ssl-cert-issues",
  "description": "Audit a target's TLS certificate beyond protocol/expiry — chain ordering, OCSP stapling, revocation status, Certificate Transparency presence, key-usage flags, and over-broad wildcards. Use when: TLS handshake already passes (skill #1 analyzing-tls-config cleared) but you suspect the cert posture is fragile. Auditors flag this during SOC2 readiness when a renewal slipped or an intermediate was rotated. Threshold: missing OCSP stapling on production, fewer than 2 SCTs in the cert, intermediate served out of order, key usage missing digitalSignature/keyEncipherment, revoked cert presented, or wildcard scope of 2-level (e.g., *.com is rejection; *.api.example.com is fine). Trigger with: \"check cert revocation\", \"audit ocsp\", \"ct log check\", \"cert chain audit\".",
  "publisher": "jeremylongshore",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "security",
      "tls",
      "ocsp",
      "certificate-transparency",
      "pentest",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Audit a target's TLS certificate beyond protocol/expiry — chain ordering, OCSP stapling, revocation status, Certificate Transparency presence, key-usage flags, and over-broad wildcards. Use when: TLS handshake already passes (skill #1 analyzing-tls-config cleared) but you suspect the cert posture is fragile. Auditors flag this during SOC2 readiness when a renewal slipped or an intermediate was rotated. Threshold: missing OCSP stapling on production, fewer than 2 SCTs in the cert, intermediate served out of order, key usage missing digitalSignature/keyEncipherment, revoked cert presented, or wildcard scope of 2-level (e.g., *.com is rejection; *.api.example.com is fine). Trigger with: \"check cert revocation\", \"audit ocsp\", \"ct log check\", \"cert chain audit\"."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/jeremylongshore/tons-of-skills-marketplace",
      "path": "plugins/security/penetration-tester/skills/detecting-ssl-cert-issues/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/jeremylongshore/tons-of-skills-marketplace/blob/HEAD/plugins/security/penetration-tester/skills/detecting-ssl-cert-issues/SKILL.md",
      "key": "jeremylongshore/tons-of-skills-marketplace/plugins/security/penetration-tester/skills/detecting-ssl-cert-issues/SKILL.md"
    },
    "compatibility": "Designed for Claude Code",
    "allowed_tools": [
      "Read",
      "Bash(python3:*)",
      "Bash(openssl:*)"
    ],
    "license": "MIT"
  },
  "instructions": "# Detecting SSL Certificate Issues\n\n## Overview\n\nThis skill is the second-level cert audit, run after `analyzing-tls-config`\nclears the protocol+cipher+expiry+hostname basics. It surfaces issues\nthat don't break the handshake today but make the cert fragile or open\nto soft-bypass attacks: missing OCSP stapling forces clients to phone\nhome to the CA (privacy + latency hit), missing Certificate Transparency\nSCTs are rejected by Chrome since 2018, an out-of-order chain confuses\nolder clients, and over-broad wildcards expand the blast radius of any\nfuture key compromise.\n\n## When the skill produce",
  "cost": {
    "context_tokens": 1419
  }
}

Fetch it by URL: GET /api/v1/registry/jeremylongshore-tons-of-skills-marketplace-detecting-ssl-d6ad1f/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.