About

Imported from mukul975/anthropic-cybersecurity-skills (skills/configuring-certificate-authority-with-openssl/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill configuring-certificate-authority-with-openssl. Copyright stays with the author (Apache-2.0).

Configuring Certificate Authority with OpenSSL

Name: configuring-certificate-authority-with-openssl
Author: mukul975

Overview

A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA + Intermediate CA) using OpenSSL and the Python cryptography library, including CRL distribution, OCSP responder configuration, and certificate policy management.

When to Use

When deploying or configuring configuring certificate authority with openssl capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Create a Root CA with self-signed certificate
Create an Intermediate CA signed by the Root CA
Issue server and client certificates from the Intermediate CA
Configure Certificate Revocation Lists (CRLs)
Implement certificate policies and constraints
Build a complete PKI hierarchy programmatically

Key Concepts

CA Hierarchy

Root CA (offline, air-gapped)
  |
  +-- Intermediate CA (online, operational)
        |
        +-- Server Certificates
        +-- Client Certificates
        +-- Code Signing Certificates

Certificate Extensions

Extension	Purpose	Critical
basicConstraints	CA:TRUE/FALSE, pathLenConstraint	Yes
keyUsage	keyCertSign, cRLSign, digitalSignature	Yes
extendedKeyUsage	serverAuth, clientAuth, codeSigning	No
subjectKeyIdentifier	Hash of public key	No
authorityKeyIdentifier	Issuer's key identifier	No
crlDistributionPoints	URL to CRL	No
authorityInfoAccess	OCSP responder URL	No

Security Considerations

Root CA private key must be stored offline (air-gapped HSM)
Use minimum 4096-bit RSA or P-384 ECDSA for CA keys
Set path length constraints on intermediate CAs
Implement certificate policies (OIDs)
Enable CRL and OCSP for revocation checking
Audit all certificate issuance operations

Validation Criteria

Root CA self-signed certificate is valid
Intermediate CA certificate chains to Root CA
Issued certificates chain to Intermediate -> Root
Path length constraints are enforced
CRL is generated and accessible
Revoked certificates appear in CRL
Certificate policies are correctly embedded

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-configuring-cert-cc730e/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-configuring-cert-cc730e.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-configuring-cert-cc730e",
  "kind": "skill",
  "name": "configuring-certificate-authority-with-openssl",
  "description": "Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, covering certificate extensions, CRL distribution points, OCSP responder configuration, and certificate policy management. Use when standing up an internal CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for TLS, code-signing, or client-authentication use cases.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "cryptography",
      "pki",
      "certificate-authority",
      "openssl",
      "x509",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, covering certificate extensions, CRL distribution points, OCSP responder configuration, and certificate policy management. Use when standing up an internal CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for TLS, code-signing, or client-authentication use cases."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/configuring-certificate-authority-with-openssl/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/configuring-certificate-authority-with-openssl/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/configuring-certificate-authority-with-openssl/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Configuring Certificate Authority with OpenSSL\n\n## Overview\n\nA Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA + Intermediate CA) using OpenSSL and the Python cryptography library, including CRL distribution, OCSP responder configuration, and certificate policy management.\n\n\n## When to Use\n\n- When deploying or configuring configuring certificate authority with openssl capabilities in your environment\n- When establishing security controls aligned ",
  "cost": {
    "context_tokens": 680
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-configuring-cert-cc730e/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.