| name | ssl-cert-toolkit |
| version | 1.0.0 |
| description | Local SSL/TLS certificate toolkit using openssl: inspect certificates, check key/cert/CSR match, generate CSRs, convert PEM/PFX, and run simple chain checks. No cloud certificate APIs. Also matches Chinese requests such as SSL 证书、 证书匹配、生成 CSR、转换证书格式、检查证书.
|
| author | aish |
| allowed-tools | ["bash","read_file","grep","glob"] |
| triggers | ["ssl-cert-toolkit","SSL certificate","certificate match","check certificate","generate CSR","convert certificate","PEM PFX","openssl certificate","key cert match","SSL 证书","证书匹配","检查证书","生成 CSR","转换证书格式"] |
| platforms | ["linux"] |
| distributions | ["deepin","debian","ubuntu","uos"] |
SSL certificate toolkit
Use openssl on this host to inspect certificates, verify key/cert/CSR pairing, generate CSRs, convert common formats, and run simple validation.
Out of scope: cloud purchase/upload/deploy APIs, silently changing the system trust store, submitting CA requests for the user.
Rules
- Clarify intent first: inspect / match / generate CSR / convert / verify—ask if unclear.
- Confirm before writing files: confirm output paths; do not overwrite existing files unless asked.
- Protect private keys: never paste key material into chat; suggest mode
0600; do not log key bodies.
- Dependency: require
openssl (command -v openssl). keytool only for JKS.
- Stop when enough: after match/inspect succeeds, do not “optimize” unrelated files.
- Fail closed on match: if OpenSSL cannot parse an input, report that—never treat empty digests as MATCH.
Capabilities
| Intent | Example asks |
|---|
| Inspect | validity dates, SAN, issuer |
| Match | are cert and key a pair; does CSR match |
| Generate CSR | create CSR to get a signed cert |
| Convert | PEM ↔ PFX/P12, split chain |
| Verify | chain OK, expired or not |
Inspect
openssl version
openssl x509 -in <cert.pem> -noout -subject -issuer -dates -ext subjectAltName 2>/dev/null
openssl x509 -in <cert.pem> -noout -text | head -80
For PFX, ask for the password; prefer -passin env:CERT_PASS over putting secrets on the command line:
openssl pkcs12 -in <file.pfx> -nokeys -clcerts -passin env:CERT_PASS
Match check (cert / key / CSR)
Compare public keys (preferred) or RSA moduli. Each openssl extract must succeed and produce non-empty output before comparing:
openssl x509 - <cert.pem> -noout -pubkey | openssl md5
openssl pkey - <key.pem> -pubout | openssl md5
openssl req - <csr.pem> -noout -pubkey | openssl md5
