Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jeremylongshore/detecting-ssl-cert-issues
Audit a target's TLS certificate beyond protocol/expiry — chain ordering, OCSP stapling, revocation status, Certificate Transparency presence, key-usage flags, and over-broad wildcards.
Passed 19 of 25 test cases with the skill, and 16 of 25 without it.
and 2 more in the full report
3 fixed16 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our application's TLS endpoint runs on a custom port 8443 instead of the default HTTPS port. Which CLI parameter specifies this non-default port during a certificate scan?
| Checked | Without skill | With skill |
|---|---|---|
| Uses the `--port 8443` parameter to target the custom TLS port. | Missed | Passed |
The instructions your model reads when the skill loads.
This skill is the second-level cert audit, run after analyzing-tls-config
clears the protocol+cipher+expiry+hostname basics. It surfaces issues
that don't break the handshake today but make the cert fragile or open
to soft-bypass attacks: missing OCSP stapling forces clients to phone
home to the CA (privacy + latency hit), missing Certificate Transparency
SCTs are rejected by Chrome since 2018, an out-of-order chain confuses
older clients, and over-broad wildcards expand the blast radius of any
future key compromise.
| Finding | Severity | Threshold | Affected control |
|---|---|---|---|
| Revoked certificate presented | CRITICAL | OCSP responder says "revoked" | RFC 6960 |
| Missing or invalid OCSP staple | HIGH | No status_request response on production | RFC 6066, CA/B BR |
| Fewer than 2 SCTs embedded | HIGH | CT-policy violation (Chrome enforces) | RFC 6962, CA/B Baseline Reqs |
| Intermediate served out of RFC 5246 order | MEDIUM | Server sends root before leaf | RFC 5246 §7.4.2 |
| AIA extension missing | MEDIUM | No CA Issuers / OCSP URL in cert | RFC 5280 §4.2.2.1 |
| Over-broad wildcard | HIGH | Scope of 2-level or wider (e.g., *.com) | CA/B Baseline Reqs §3.2.2 |
| Wildcard at apex SAN | LOW | *.example.com without example.com | RFC 6125 §6.4.3 |
| Key Usage missing digitalSignature | MEDIUM | KU bit absent for TLS server cert | RFC 5280 §4.2.1.3 |
| Cert chain longer than 4 | LOW | Performance + trust expansion | CA/B Baseline Reqs |
cryptography libraryopenssl CLI 1.1.1+ (for OCSP query + chain enumeration)references/AUTHORIZATION.md
in skill #1 analyzing-tls-config for the canonical pattern)Active scan; ask the user verbatim:
test cases passed, vs 16 / 25 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.