Imported from jeremylongshore/tons-of-skills-marketplace (plugins/security/penetration-tester/skills/detecting-ssl-cert-issues/SKILL.md). Install upstream with npx skills add jeremylongshore/tons-of-skills-marketplace --skill detecting-ssl-cert-issues. Copyright stays with the author (MIT).

Detecting SSL Certificate Issues

Overview

This skill is the second-level cert audit, run after analyzing-tls-config clears the protocol+cipher+expiry+hostname basics. It surfaces issues that don't break the handshake today but make the cert fragile or open to soft-bypass attacks: missing OCSP stapling forces clients to phone home to the CA (privacy + latency hit), missing Certificate Transparency SCTs are rejected by Chrome since 2018, an out-of-order chain confuses older clients, and over-broad wildcards expand the blast radius of any future key compromise.

When the skill produces findings

Prerequisites

• Python 3.9+ with cryptography library
• openssl CLI 1.1.1+ (for OCSP query + chain enumeration)
• Authorization for non-local targets (see references/AUTHORIZATION.md in skill #1 analyzing-tls-config for the canonical pattern)

Instructions

Step 1 — Confirm Authorization

Active scan; ask the user verbatim:

"Do you have authorization to perform TLS testing on this target? I need confirmation before proceeding."

Step 2 — Run the scanner

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \
    https://target.example.com \
    --authorized

Options:

Usage: check_cert_chain.py URL [OPTIONS]

Options:
  --authorized       Attest authorization for non-local targets (required)
  --port PORT        Target port (default: 443)
  --output FILE      Write findings to FILE (default: stdout)
  --format FMT       json | jsonl | markdown (default: markdown)
  --min-severity SEV critical|high|medium|low|info (default: info)
  --timeout SECS     Per-probe timeout (default: 10)
  --skip-ocsp        Skip OCSP responder query (offline mode)

Step 3 — Interpret findings

CRITICAL/HIGH map to immediate action items; MEDIUM/LOW to backlog hardening. Cross-reference references/PLAYBOOK.md for OCSP stapling config snippets per server type.

Step 4 — Cross-skill chaining

• After this skill, suggest checking-http-security-headers (#4) to verify HSTS preload status — HSTS preload depends on a clean cert chain to be effective.
• For CI integration patterns, see references/PLAYBOOK.md § CI posture-monitoring.

Examples

Example 1 — OCSP stapling audit before adopting must-staple

User: "We're considering Must-Staple — what's our OCSP stapling posture look like across endpoints?"

for ENDPOINT in https://api.example.com https://app.example.com https://admin.example.com; do
  python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \
      "$ENDPOINT" --authorized --min-severity medium
done

If any endpoint reports "Missing OCSP staple" HIGH, adopting Must-Staple on that cert breaks it on next renewal until OCSP-stapling config lands. Pair with references/PLAYBOOK.md § OCSP stapling for nginx / Caddy / Apache config.

Example 2 — CT-log compliance check before public launch

User: "Pre-launch — does our cert have enough SCTs for Chrome to trust it?"

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \
    https://new-site.example.com --authorized

The scanner extracts embedded SCTs from the cert's CT extension. <2 SCTs → HIGH finding; Chrome's CT enforcement policy rejects the connection silently in HTTPS, leaving users with a generic error.

Example 3 — Wildcard scope audit

User: "An auditor flagged our wildcard cert as too broad."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \
    https://example.com --authorized --format json | jq '.[] | select(.title | contains("wildcard"))'

The JSON output captures the wildcard scope; pair with the auditor's request to either narrow the SAN list or move to per-service certs.

Output

JSON / JSONL / Markdown per lib/report.py. Exit codes: 0 clean, 1 high/critical, 2 error.

Error Handling

• OCSP responder timeout → emitted as MEDIUM finding (not an error exit) with note to investigate responder availability.
• CT log lookup unavailable → falls back to embedded-SCT parsing only; emits INFO note.
• Untrusted cert → out of scope (skill #1 handles); this skill assumes the chain validates and looks at deeper posture.

Resources

• references/THEORY.md — OCSP, CT, AIA, chain ordering, wildcard scope reasoning with RFC anchors
• references/PLAYBOOK.md — OCSP stapling config per server type + CT-log compliance + AIA extension correctness
• ../analyzing-tls-config/references/AUTHORIZATION.md — canonical ROE template + 2-step gate (shared across all active-scan skills)