name	ssl-certificate
description	Check SSL/TLS certificate expiry and chain validity using openssl. Alerts on certificates expiring within 30 days.
requires	{"bins":["openssl"]}

SSL/TLS certificate checking skill.

When to activate

When the user asks about SSL or certificate status
As a periodic deep check (check memory for last SSL check date -- run at most once per week per endpoint)

Check command

echo | openssl s_client -connect <host>:443 -servername <host> 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Replace <host> with the hostname extracted from the endpoint URL (strip the protocol and path).

Parsing output

The command returns:

notBefore= -- certificate start date
notAfter= -- certificate expiry date
subject= -- certificate subject (CN and/or SAN)
issuer= -- certificate issuer (CA name)

Calculate days until expiry from the notAfter date using the current timestamp from datetime.

Alert thresholds

Days remaining	Severity
> 30	No alert
14-30	Warning
7-14	Warning (urgent)
1-7	Critical
0 or expired	Critical (emergency)

Additional checks

Subject match: Verify the CN or SAN matches the hostname being checked. Mismatches indicate a misconfigured certificate.
Issuer: Check if the issuer is a recognized CA. Self-signed certificates in production are a finding.

MUST

Include the exact expiry date and days remaining in the alert
Include the hostname checked and the issuer name
Store the SSL check result in semantic memory with category "ssl_check" to avoid redundant checks

MUST NOT

Alert on self-signed certificates for staging/dev URLs (check if the URL contains "staging", "dev", "local", "localhost", "test")
Run SSL checks more than once per week per endpoint (check memory first)

المزيد من هذا المستودع

نفس المستودع

prompt-craft

vladkesler/initrunner

Translate natural language image descriptions into detailed, structured DALL-E prompts with subject, style, composition, lighting, and mood specifications.

2026-03-2139

step-by-step

vladkesler/initrunner

Decompose mathematical problems into sub-expressions, evaluate each one with the calculator tool, and present the full working chain. Handles arithmetic, trigonometry, logarithms, and financial formulas.

2026-03-2139

document-comparison

vladkesler/initrunner

Compare two or more PDF documents by extracting targeted sections, building a structured comparison matrix, and highlighting differences with page references.

2026-03-2139

structured-extraction

vladkesler/initrunner

Extract structured data from web pages using browser snapshot and text tools, then process it into tables, comparisons, or summaries using Python.

2026-03-2139

latency-analysis

vladkesler/initrunner

Analyze endpoint latency trends using historical check data from memory. Detects slow degradation, spikes vs sustained issues, and calculates baseline deviations.

2026-03-1939

response-validation

vladkesler/initrunner

Validate API response structure and content. Detects schema drift, unexpected null values, and abnormal response sizes.

2026-03-1939

name	ssl-certificate
description	Check SSL/TLS certificate expiry and chain validity using openssl. Alerts on certificates expiring within 30 days.
requires	{"bins":["openssl"]}

SSL/TLS certificate checking skill.

When to activate

When the user asks about SSL or certificate status
As a periodic deep check (check memory for last SSL check date -- run at most once per week per endpoint)

Check command

echo | openssl s_client -connect <host>:443 -servername <host> 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Replace <host> with the hostname extracted from the endpoint URL (strip the protocol and path).

Parsing output

The command returns:

notBefore= -- certificate start date
notAfter= -- certificate expiry date
subject= -- certificate subject (CN and/or SAN)
issuer= -- certificate issuer (CA name)

Calculate days until expiry from the notAfter date using the current timestamp from datetime.

Alert thresholds

Days remaining	Severity
> 30	No alert
14-30	Warning
7-14	Warning (urgent)
1-7	Critical
0 or expired	Critical (emergency)

Additional checks

Subject match: Verify the CN or SAN matches the hostname being checked. Mismatches indicate a misconfigured certificate.
Issuer: Check if the issuer is a recognized CA. Self-signed certificates in production are a finding.

MUST

Include the exact expiry date and days remaining in the alert
Include the hostname checked and the issuer name
Store the SSL check result in semantic memory with category "ssl_check" to avoid redundant checks

MUST NOT

Alert on self-signed certificates for staging/dev URLs (check if the URL contains "staging", "dev", "local", "localhost", "test")
Run SSL checks more than once per week per endpoint (check memory first)