performing-ssl-certificate-lifecycle-management skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Automates the full SSL/TLS certificate lifecycle, including generating Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/performing-ssl-certificate-lifecycle-management/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-ssl-certificate-lifecycle-management, or copy the skill folder into ~/.claude/skills/performing-ssl-certificate-lifecycle-management/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-certificate-lifecycle-management/SKILL.md

SKILL.md (verbatim)

name: performing-ssl-certificate-lifecycle-management
description: Automates the full SSL/TLS certificate lifecycle, including generating
  Certificate Signing Requests, issuing, deploying, monitoring, renewing, and revoking
  X.509 certificates, using Python and ACME protocol tools. Use when managing certificate
  issuance or renewal, preventing certificate-expiry outages, or building automated
  PKI/ACME workflows.
domain: cybersecurity
subdomain: cryptography
tags:
- cryptography
- ssl
- certificates
- pki
- tls
- key-management
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.DS-01
- PR.DS-02
- PR.DS-10
mitre_attack:
- T1600
- T1573
- T1553
- T1040

Performing SSL Certificate Lifecycle Management

Overview

SSL/TLS certificate lifecycle management encompasses the full process of requesting, issuing, deploying, monitoring, renewing, and revoking X.509 certificates. Poor certificate management is a leading cause of outages and security incidents. This skill covers automating the entire certificate lifecycle using Python and ACME protocol tools.

When to Use

  • When conducting security assessments that involve performing ssl certificate lifecycle management
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Familiarity with cryptography concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Objectives

  • Generate Certificate Signing Requests (CSRs) programmatically
  • Parse and validate X.509 certificates
  • Monitor certificate expiration across infrastructure
  • Automate renewal using ACME protocol (Let's Encrypt)
  • Implement certificate revocation checking (CRL and OCSP)
  • Track certificate inventory across multiple domains

Key Concepts

Certificate Lifecycle Stages

  1. Request: Generate key pair and CSR
  2. Issuance: CA validates and issues certificate
  3. Deployment: Install certificate on servers
  4. Monitoring: Track expiration and health
  5. Renewal: Request new certificate before expiry
  6. Revocation: Invalidate compromised certificates

Certificate Types

Type Validation Use Case
DV (Domain Validation) Domain ownership Websites, APIs
OV (Organization Validation) Domain + org identity Business sites
EV (Extended Validation) Full legal verification E-commerce, banking
Wildcard *.domain.com Multi-subdomain
SAN/UCC Multiple domains Multi-domain hosting

Security Considerations

  • Set up automated monitoring for all certificates
  • Use ECDSA (P-256) certificates for better performance over RSA
  • Enable OCSP stapling on all servers
  • Implement Certificate Transparency log monitoring
  • Maintain inventory of all certificates and their locations
  • Plan for CA compromise scenarios (key pinning, backup CAs)

Validation Criteria

  • CSR generation produces valid PKCS#10 request
  • Certificate parsing extracts all relevant fields
  • Expiration monitoring detects certificates within threshold
  • Certificate chain validation verifies trust path
  • OCSP checking detects revoked certificates
  • Certificate inventory tracks all deployed certificates

Other files in this skill

assets/template.md (verbatim)

SSL Certificate Lifecycle Management Template

Certificate Inventory Template

Domain Type CA Issued Expires Days Left Status
example.com DV Let's Encrypt 2024-01-01 2024-04-01 90 OK
api.example.com DV DigiCert 2024-01-01 2025-01-01 365 OK

Monitoring Thresholds

monitoring:
  ok_threshold: 30        # days
  warning_threshold: 15   # days
  critical_threshold: 7   # days
  check_interval: 86400   # seconds (daily)
  notification:
    email: security@example.com
    slack: "#cert-alerts"

CSR Generation Command

# ECDSA (recommended)
openssl ecparam -genkey -name prime256v1 -out server.key
openssl req -new -key server.key -out server.csr -subj "/CN=example.com"

# RSA 4096
openssl genrsa -out server.key 4096
openssl req -new -key server.key -out server.csr -subj "/CN=example.com"

Renewal Automation (certbot)

# Initial issuance
certbot certonly --nginx -d example.com -d www.example.com

# Auto-renewal (cron)
0 0 * * * certbot renew --quiet --deploy-hook "systemctl reload nginx"

Revocation Checklist

  • Identify affected certificate(s)
  • Contact CA to initiate revocation
  • Provide revocation reason (key compromise, cessation, etc.)
  • Verify revocation in CRL/OCSP
  • Issue replacement certificate
  • Deploy replacement to all affected servers
  • Update certificate inventory
  • Document incident

references/api-reference.md (verbatim)

API Reference: SSL Certificate Lifecycle Management

cryptography Library - CSR Generation

Class / Method Description
ec.generate_private_key(ec.SECP256R1()) Generate ECDSA P-256 private key
rsa.generate_private_key(65537, 2048) Generate RSA 2048-bit private key
x509.CertificateSigningRequestBuilder() Build a PKCS#10 CSR
.subject_name(x509.Name([...])) Set CSR subject
.add_extension(SubjectAlternativeName(...)) Add SAN extension
.sign(private_key, hashes.SHA256()) Sign CSR with private key

cryptography Library - Certificate Parsing

Method Description
x509.load_pem_x509_certificate(data) Parse PEM certificate
x509.load_der_x509_certificate(data) Parse DER certificate
cert.subject Get subject Distinguished Name
cert.issuer Get issuer Distinguished Name
cert.not_valid_after_utc Expiration datetime
cert.serial_number Certificate serial number
cert.extensions.get_extension_for_oid(OID) Get specific extension

Python ssl Module

Function Description
ssl.create_default_context() Create SSL context with system CAs
ctx.wrap_socket(sock, server_hostname=host) TLS handshake
s.getpeercert(binary_form=True) Get DER-encoded server certificate
s.getpeercert() Get parsed certificate dict

Certificate Types

Type Validation Typical Use
DV Domain ownership Websites, APIs
OV Organization verified Business applications
EV Full legal verification E-commerce, banking
Wildcard *.domain.com Multi-subdomain

Python Libraries

Library Version Purpose
cryptography >=41.0 CSR generation, certificate parsing
ssl stdlib TLS handshake, remote cert fetch
socket stdlib TCP connections

References

references/standards.md (verbatim)

Standards and References - SSL Certificate Lifecycle Management

Primary Standards

RFC 5280 - Internet X.509 PKI Certificate and CRL Profile

RFC 6960 - X.509 Online Certificate Status Protocol (OCSP)

RFC 8555 - Automatic Certificate Management Environment (ACME)

RFC 6962 - Certificate Transparency

RFC 2986 - PKCS #10: Certification Request Syntax

NIST SP 800-57 Part 3 - Application-Specific Key Management

Tools

Let's Encrypt / Certbot

Certificate Transparency Logs

Mozilla Observatory

references/workflows.md (verbatim)

Workflows - SSL Certificate Lifecycle Management

Workflow 1: Certificate Request and Issuance

[Generate Private Key] (ECDSA P-256 or RSA 4096)
      |
[Create CSR] (PKCS#10)
(CN, SAN, Organization, etc.)
      |
[Submit CSR to CA]
      |
[CA Validates Domain/Org]
(DNS, HTTP, or Email challenge)
      |
[CA Issues Certificate]
      |
[Download Certificate + Chain]
      |
[Verify Certificate Chain]
      |
[Deploy to Server]

Workflow 2: Expiration Monitoring

[Certificate Inventory] (list of all domains/endpoints)
      |
[For Each Endpoint]:
  [Connect and retrieve certificate]
  [Parse notAfter field]
  [Calculate days remaining]
      |
[Apply Threshold Rules]:
  > 30 days: OK
  15-30 days: WARNING
  < 15 days: CRITICAL
  Expired: ALERT
      |
[Generate Report / Send Alerts]

Workflow 3: Automated Renewal (ACME)

[Cron Job / Scheduler]
      |
[Check Certificate Expiry]
      |
[< 30 days remaining?]
  NO  --> Sleep
  YES --> [Initiate ACME Renewal]
              |
          [Complete Challenge]
          (HTTP-01, DNS-01, TLS-ALPN-01)
              |
          [Receive New Certificate]
              |
          [Deploy and Reload Server]
              |
          [Verify New Certificate Works]

Workflow 4: Certificate Revocation

[Security Incident Detected]
(key compromise, CA breach, etc.)
      |
[Revoke Certificate with CA]
(provide reason code)
      |
[Verify in CRL / OCSP]
      |
[Issue Replacement Certificate]
      |
[Deploy Replacement]
      |
[Update Certificate Inventory]

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.