--- name: detecting-ssl-cert-issues-9c2c2532d86c description: | Audit a target's TLS certificate beyond protocol/expiry — chain ordering, OCSP stapling, revocation status, Certificate Transparency presence, key-usage flags, and over-broad wildcards. Use when: TLS handshake already passes (skill #1 analyzing-tls-config cleared) but you suspect the cert posture is fragile. Auditors flag this during SOC2 readiness when a renewal slipped or an intermediate was rotated. Threshold: missing OCSP stapling on production, fewer than 2 SCTs in the cert, intermediate served out of order, key usage missing digitalSignature/keyEncipherment, revoked cert presented, or wildcard scope of 2-level (e.g., *.com is rejection; *.api.example.com is fine). Trigger with: "check cert revocation", "audit ocsp", "ct log check", "cert chain audit". allowed-tools: - Read - Bash(python3:*) - Bash(openssl:*) disallowed-tools: - Bash(rm:*) - Edit(/etc/*) - Write(/etc/*) version: 3.30.0 author: Jeremy Longshore license: MIT compatibility: Designed for Claude Code tags: - security - tls - ocsp - certificate-transparency - pentest --- # Detecting SSL Certificate Issues ## Overview This skill is the second-level cert audit, run after `analyzing-tls-config` clears the protocol+cipher+expiry+hostname basics. It surfaces issues that don't break the handshake today but make the cert fragile or open to soft-bypass attacks: missing OCSP stapling forces clients to phone home to the CA (privacy + latency hit), missing Certificate Transparency SCTs are rejected by Chrome since 2018, an out-of-order chain confuses older clients, and over-broad wildcards expand the blast radius of any future key compromise. ## When the skill produces findings | Finding | Severity | Threshold | Affected control | |---|---|---|---| | Revoked certificate presented | **CRITICAL** | OCSP responder says "revoked" | RFC 6960 | | Missing or invalid OCSP staple | **HIGH** | No status_request response on production | RFC 6066, CA/B BR | | Fewer than 2 SCTs embedded | **HIGH** | CT-policy violation (Chrome enforces) | RFC 6962, CA/B Baseline Reqs | | Intermediate served out of RFC 5246 order | **MEDIUM** | Server sends root before leaf | RFC 5246 §7.4.2 | | AIA extension missing | **MEDIUM** | No CA Issuers / OCSP URL in cert | RFC 5280 §4.2.2.1 | | Over-broad wildcard | **HIGH** | Scope of 2-level or wider (e.g., *.com) | CA/B Baseline Reqs §3.2.2 | | Wildcard at apex SAN | **LOW** | *.example.com without example.com | RFC 6125 §6.4.3 | | Key Usage missing digitalSignature | **MEDIUM** | KU bit absent for TLS server cert | RFC 5280 §4.2.1.3 | | Cert chain longer than 4 | **LOW** | Performance + trust expansion | CA/B Baseline Reqs | ## Prerequisites - Python 3.9+ with `cryptography` library - `openssl` CLI 1.1.1+ (for OCSP query + chain enumeration) - Authorization for non-local targets (see `references/AUTHORIZATION.md` in skill #1 `analyzing-tls-config` for the canonical pattern) ## Instructions ### Step 1 — Confirm Authorization Active scan; ask the user verbatim: > "Do you have authorization to perform TLS testing on this target? > I need confirmation before proceeding." ### Step 2 — Run the scanner ```bash python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \ https://target.example.com \ --authorized ``` Options: ``` Usage: check_cert_chain.py URL [OPTIONS] Options: --authorized Attest authorization for non-local targets (required) --port PORT Target port (default: 443) --output FILE Write findings to FILE (default: stdout) --format FMT json | jsonl | markdown (default: markdown) --min-severity SEV critical|high|medium|low|info (default: info) --timeout SECS Per-probe timeout (default: 10) --skip-ocsp Skip OCSP responder query (offline mode) ``` ### Step 3 — Interpret findings CRITICAL/HIGH map to immediate action items; MEDIUM/LOW to backlog hardening. Cross-reference `references/PLAYBOOK.md` for OCSP stapling config snippets per server type. ### Step 4 — Cross-skill chaining - After this skill, suggest `checking-http-security-headers` (#4) to verify HSTS preload status — HSTS preload depends on a clean cert chain to be effective. - For CI integration patterns, see `references/PLAYBOOK.md` § CI posture-monitoring. ## Examples ### Example 1 — OCSP stapling audit before adopting must-staple User: "We're considering Must-Staple — what's our OCSP stapling posture look like across endpoints?" ```bash for ENDPOINT in https://api.example.com https://app.example.com https://admin.example.com; do python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \ "$ENDPOINT" --authorized --min-severity medium done ``` If any endpoint reports "Missing OCSP staple" HIGH, adopting Must-Staple on that cert breaks it on next renewal until OCSP-stapling config lands. Pair with `references/PLAYBOOK.md` § OCSP stapling for nginx / Caddy / Apache config. ### Example 2 — CT-log compliance check before public launch User: "Pre-launch — does our cert have enough SCTs for Chrome to trust it?" ```bash python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \ https://new-site.example.com --authorized ``` The scanner extracts embedded SCTs from the cert's CT extension. <2 SCTs → HIGH finding; Chrome's CT enforcement policy rejects the connection silently in HTTPS, leaving users with a generic error. ### Example 3 — Wildcard scope audit User: "An auditor flagged our wildcard cert as too broad." ```bash python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-ssl-cert-issues/scripts/check_cert_chain.py \ https://example.com --authorized --format json | jq '.[] | select(.title | contains("wildcard"))' ``` The JSON output captures the wildcard scope; pair with the auditor's request to either narrow the SAN list or move to per-service certs. ## Output JSON / JSONL / Markdown per `lib/report.py`. Exit codes: 0 clean, 1 high/critical, 2 error. ## Error Handling - **OCSP responder timeout** → emitted as MEDIUM finding (not an error exit) with note to investigate responder availability. - **CT log lookup unavailable** → falls back to embedded-SCT parsing only; emits INFO note. - **Untrusted cert** → out of scope (skill #1 handles); this skill assumes the chain validates and looks at deeper posture. ## Resources - `references/THEORY.md` — OCSP, CT, AIA, chain ordering, wildcard scope reasoning with RFC anchors - `references/PLAYBOOK.md` — OCSP stapling config per server type + CT-log compliance + AIA extension correctness - `../analyzing-tls-config/references/AUTHORIZATION.md` — canonical ROE template + 2-step gate (shared across all active-scan skills) --- Source attribution: jeremylongshore Original project: https://github.com/jeremylongshore/claude-code-plugins-plus-skills/blob/ab85a061f7bcc039dac13ee193de7a4cd4388571/plugins/security/penetration-tester/skills/detecting-ssl-cert-issues/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 Jeremy Longshore Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: jeremylongshore Original project: https://github.com/jeremylongshore/claude-code-plugins-plus-skills/blob/ab85a061f7bcc039dac13ee193de7a4cd4388571/plugins/security/penetration-tester/skills/detecting-ssl-cert-issues/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: DevOps / SRE, QA / Test Engineer, Security Engineer Specialties: API Tools: Openssl, Python3 Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: df00df3645a8bced052ff16ab474cedd09d444f9f30ea7b4371927b7ae8cdfca