메뉴
Expert skill for TLS/SSL implementation and certificate management. Generate and validate TLS configurations, create and manage X.509 certificates, analyze cipher suite security, debug TLS handshake failures, and implement certificate pinning.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/a5c-ai/babysitter --skill tls-security명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Reference for querying the Atlas knowledge graph through its MCP tools — the SECONDARY enrichment/comparison layer that adds best-practice context to systems you have ALREADY scanned from your real sources (`az`, repos, dirs). Use when you need to look up nodes, edges, kinds, clusters, stats, or wiki pages in Atlas to compare against your real inventory. (atlas graph, query atlas, atlas mcp, search the graph, graph neighbors, atlas record, atlas kinds, enrichment layer)
Atlas turns your STATED NEED into a real systems atlas by SCANNING your actual sources (Azure via `az`, git repos, local dirs) and process/data mining them, THEN enriching against the Atlas knowledge graph. Use this skill when asked to inventory/map your real systems, scan your cloud + repos + directories, mine the real processes or data they contain, or collect their real constraints/gotchas. (atlas, scan my systems, inventory our azure account, map my repos, real systems atlas, process mining, data mining, collect nuances, system discovery)
This skill should be used when the user asks to "find skills in the wild", "assimilate popular workflows", "discover SKILL.md files in repos", "research external skills", "find workflow patterns", "survey the skill landscape", "what skills exist out there", or wants to investigate public repositories for extractable processes, babysitter plugins, and reusable procedural insights. Searches GitHub for SKILL.md files, classifies repos by archetype, and maintains structured research under docs/reference-repos/.
SKILL.md 표시 중
SOC 직업 분류 기준
| name | tls-security |
| description | Expert skill for TLS/SSL implementation and certificate management. Generate and validate TLS configurations, create and manage X.509 certificates, analyze cipher suite security, debug TLS handshake failures, and implement certificate pinning. |
| allowed-tools | Bash(*) Read Write Edit Glob Grep WebFetch |
| metadata | {"author":"babysitter-sdk","version":"1.0.0","category":"network-security","backlog-id":"SK-004"} |
| graph | {"domains":["domain:networking"],"specializations":["specialization:network-programming"],"skillAreas":["skill-area:protocol-design","skill-area:socket-programming"],"roles":["role:backend-engineer","role:sre"],"topics":["topic:circuit-breakers","topic:ssl-certs"]} |
You are tls-security - a specialized skill for TLS/SSL implementation and certificate management, providing deep expertise in secure communication protocols, certificate lifecycle, and cryptographic configuration.
This skill enables AI-powered TLS/SSL operations including:
openssl command)certbot for Let's Encrypt certificatestestssl.sh for vulnerability scanningGenerate X.509 certificates for various use cases:
# Generate CA private key
openssl genrsa -out ca.key 4096
# Generate CA certificate (10 years)
openssl req -new -x509 -sha256 -days 3650 \
-key ca.key \
-out ca.crt \
-subj "/C=US/ST=California/L=San Francisco/O=MyOrg/CN=MyOrg Root CA"
# Generate server private key
openssl genrsa -out server.key 2048
# Generate CSR
openssl req -new -sha256 \
-key server.key \
-out server.csr \
-subj "/C=US/ST=California/L=San Francisco/O=MyOrg/CN=server.example.com"
# Create extensions file for SAN
cat > server.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = server.example.com
DNS.2 = *.example.com
IP.1 = 192.168.1.100
EOF
# Sign with CA
openssl x509 -req -sha256 -days 365 \
-in server.csr \
-CA ca.crt \
-CAkey ca.key \
-CAcreateserial \
-out server.crt \
-extfile server.ext
# Generate client key
openssl genrsa -out client.key 2048
# Generate CSR
openssl req -new -sha256 \
-key client.key \
-out client.csr \
-subj "/C=US/ST=California/L=San Francisco/O=MyOrg/CN=client@example.com"
# Create client extensions
cat > client.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature
extendedKeyUsage = clientAuth
EOF
# Sign with CA
openssl x509 -req -sha256 -days 365 \
-in client.csr \
-CA ca.crt \
-CAkey ca.key \
-CAcreateserial \
-out client.crt \
-extfile client.ext
Generate secure TLS configurations:
# Modern TLS configuration (A+ grade)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;
# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/ca.crt;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
# Session settings
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
# DH parameters (generate with: openssl dhparam -out dhparam.pem 4096)
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
# HSTS
add_header Strict-Transport-Security "max-age=63072000" always;
global
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
frontend https
bind *:443 ssl crt /etc/haproxy/certs/ alpn h2,http/1.1
http-response set-header Strict-Transport-Security "max-age=63072000"
Validate certificates and chains:
# View certificate details
openssl x509 -in server.crt -text -noout
# Verify certificate chain
openssl verify -CAfile ca.crt server.crt
# Check certificate dates
openssl x509 -in server.crt -noout -dates
# Check certificate against private key
openssl x509 -noout -modulus -in server.crt | openssl md5
openssl rsa -noout -modulus -in server.key | openssl md5
# (hashes should match)
# Test TLS connection
openssl s_client -connect server.example.com:443 \
-servername server.example.com \
-CAfile ca.crt
# Check certificate expiration
echo | openssl s_client -connect server.example.com:443 2>/dev/null | \
openssl x509 -noout -enddate
Debug TLS connection issues:
# Verbose TLS handshake
openssl s_client -connect server.example.com:443 \
-servername server.example.com \
-state -debug
# Check supported protocols
openssl s_client -connect server.example.com:443 -tls1_2
openssl s_client -connect server.example.com:443 -tls1_3
# List supported ciphers
openssl s_client -connect server.example.com:443 -cipher 'ALL' 2>&1 | \
grep -E "Cipher|Protocol"
# Test specific cipher
openssl s_client -connect server.example.com:443 \
-cipher ECDHE-RSA-AES256-GCM-SHA384
# Check certificate chain
openssl s_client -connect server.example.com:443 -showcerts
Analyze TLS security posture:
# Using testssl.sh
./testssl.sh --severity HIGH server.example.com:443
# Check for vulnerabilities
./testssl.sh --vulnerable server.example.com:443
# Check cipher strength
./testssl.sh --cipher-per-proto server.example.com:443
# Using nmap
nmap --script ssl-enum-ciphers -p 443 server.example.com
# Generate pin hash
openssl x509 -in server.crt -pubkey -noout | \
openssl pkey -pubin -outform der | \
openssl dgst -sha256 -binary | \
openssl enc -base64
import ssl
import hashlib
import base64
from urllib.request import urlopen
# Expected certificate pin (SHA256 of SPKI)
EXPECTED_PIN = "base64encodedpin=="
def verify_pin(cert_der):
"""Verify certificate public key pin."""
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization
cert = x509.load_der_x509_certificate(cert_der, default_backend())
spki = cert.public_key().public_bytes(
encoding=serialization.Encoding.DER,
format=serialization.PublicFormat.SubjectPublicKeyInfo
)
pin = base64.b64encode(hashlib.sha256(spki).digest()).decode()
return pin == EXPECTED_PIN
# Create SSL context with custom verification
ctx = ssl.create_default_context()
ctx.check_hostname = True
ctx.verify_mode = ssl.CERT_REQUIRED
Configure mutual TLS authentication:
import ssl
# Server-side mTLS
server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
server_context.minimum_version = ssl.TLSVersion.TLSv1_2
server_context.load_cert_chain('server.crt', 'server.key')
server_context.load_verify_locations('ca.crt')
server_context.verify_mode = ssl.CERT_REQUIRED # Require client cert
# Client-side mTLS
client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
client_context.minimum_version = ssl.TLSVersion.TLSv1_2
client_context.load_cert_chain('client.crt', 'client.key')
client_context.load_verify_locations('ca.crt')
client_context.check_hostname = True
client_context.verify_mode = ssl.CERT_REQUIRED
This skill can leverage the following MCP servers for enhanced capabilities:
| Server | Description | Integration |
|---|---|---|
| TLS MCP Server | Fetch and analyze TLS certificates | Certificate inspection |
| mcp-for-security | SSL/TLS configuration analysis | Vulnerability scanning |
# Add to Claude
claude mcp add tls-mcp -- npx @malaya-zemlya/tls-mcp
Capabilities:
This skill integrates with the following processes:
tls-integration.js - TLS implementationmtls-implementation.js - Mutual TLS setupcertificate-management.js - Certificate lifecycleWhen executing operations, provide structured output:
{
"operation": "analyze",
"target": "server.example.com:443",
"status": "success",
"certificate": {
"subject": "CN=server.example.com",
"issuer": "CN=MyOrg Root CA",
"validFrom": "2026-01-01T00:00:00Z",
"validTo": "2027-01-01T00:00:00Z",
"serialNumber": "01",
"signatureAlgorithm": "sha256WithRSAEncryption",
"keySize": 2048
},
"tls": {
"version": "TLSv1.3",
"cipher": "TLS_AES_256_GCM_SHA384",
"hsts": true,
"ocspStapling": true
},
"vulnerabilities": [],
"grade": "A+"
}