| name | detecting-ssl-cert-issues |
| description | Audit a target's TLS certificate beyond protocol/expiry — chain ordering,
OCSP stapling, revocation status, Certificate Transparency presence,
key-usage flags, and over-broad wildcards.
Use when: TLS handshake already passes (skill #1 analyzing-tls-config
cleared) but you suspect the cert posture is fragile. Auditors flag this
during SOC2 readiness when a renewal slipped or an intermediate was
rotated.
Threshold: missing OCSP stapling on production, fewer than 2 SCTs in
the cert, intermediate served out of order, key usage missing
digitalSignature/keyEncipherment, revoked cert presented, or wildcard
scope of 2-level (e.g., *.com is rejection; *.api.example.com is fine).
Trigger with: "check cert revocation", "audit ocsp", "ct log check",
"cert chain audit".
|
| allowed-tools | ["Read","Bash(python3:*)","Bash(openssl:*)"] |
| disallowed-tools | ["Bash(rm:*)","Edit(/etc/*)","Write(/etc/*)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","tls","ocsp","certificate-transparency","pentest"] |
Detecting SSL Certificate Issues
Overview
This skill is the second-level cert audit, run after analyzing-tls-config
clears the protocol+cipher+expiry+hostname basics. It surfaces issues
that don't break the handshake today but make the cert fragile or open
to soft-bypass attacks: missing OCSP stapling forces clients to phone
home to the CA (privacy + latency hit), missing Certificate Transparency
SCTs are rejected by Chrome since 2018, an out-of-order chain confuses
older clients, and over-broad wildcards expand the blast radius of any
future key compromise.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| Revoked certificate presented | CRITICAL | OCSP responder says "revoked" | RFC 6960 |
| Missing or invalid OCSP staple | HIGH | No status_request response on production | RFC 6066, CA/B BR |
| Fewer than 2 SCTs embedded | HIGH | CT-policy violation (Chrome enforces) | RFC 6962, CA/B Baseline Reqs |
| Intermediate served out of RFC 5246 order | MEDIUM | Server sends root before leaf | RFC 5246 §7.4.2 |
| AIA extension missing | MEDIUM | No CA Issuers / OCSP URL in cert | RFC 5280 §4.2.2.1 |
| Over-broad wildcard | HIGH | Scope of 2-level or wider (e.g., *.com) | CA/B Baseline Reqs §3.2.2 |
| Wildcard at apex SAN | LOW | *.example.com without example.com | RFC 6125 §6.4.3 |
| Key Usage missing digitalSignature | MEDIUM | KU bit absent for TLS server cert | RFC 5280 §4.2.1.3 |
| Cert chain longer than 4 | LOW | Performance + trust expansion | CA/B Baseline Reqs |
Prerequisites
- Python 3.9+ with
cryptography library
openssl CLI 1.1.1+ (for OCSP query + chain enumeration)- Authorization for non-local targets (see
references/AUTHORIZATION.md
in skill #1 for the canonical pattern)
