메뉴
Local SSL/TLS certificate toolkit using openssl: inspect certificates, check key/cert/CSR match, generate CSRs, convert PEM/PFX, and run simple chain checks. No cloud certificate APIs. Also matches Chinese requests such as SSL 证书、 证书匹配、生成 CSR、转换证书格式、检查证书.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/AI-Shell-Team/aish --skill ssl-cert-toolkit명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Local Linux lag and performance diagnosis. Run read-only probes based on the user's symptoms to find CPU, memory, disk, or local network bottlenecks, then give safe advice. Never auto-remediate. Also matches Chinese requests such as 系统卡顿、机器好慢、内存不足、突然重启、OOM、磁盘很慢.
Local DNS resolution troubleshooting with dig/resolvectl/whois. Investigate NXDOMAIN, wrong answers, records not taking effect, and resolver failures. Read-only; do not change DNS config. Also matches Chinese requests such as DNS 解析失败、域名解析不了、NXDOMAIN、解析不到.
Diagnose network path quality from this host to a target using ping/mtr/curl. Investigate packet loss, high latency, jitter, and reachability failures; interpret hop results and suggest follow-up tests. Do not change network config. Also matches Chinese requests such as 网络丢包、延迟高、链路质量、ping 不通、网络抖动.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | ssl-cert-toolkit |
| version | 1.0.0 |
| description | Local SSL/TLS certificate toolkit using openssl: inspect certificates, check key/cert/CSR match, generate CSRs, convert PEM/PFX, and run simple chain checks. No cloud certificate APIs. Also matches Chinese requests such as SSL 证书、 证书匹配、生成 CSR、转换证书格式、检查证书. |
| author | aish |
| allowed-tools | ["bash","read_file","grep","glob"] |
| triggers | ["ssl-cert-toolkit","SSL certificate","certificate match","check certificate","generate CSR","convert certificate","PEM PFX","openssl certificate","key cert match","SSL 证书","证书匹配","检查证书","生成 CSR","转换证书格式"] |
| platforms | ["linux"] |
| distributions | ["deepin","debian","ubuntu","uos"] |
Use openssl on this host to inspect certificates, verify key/cert/CSR pairing, generate CSRs, convert common formats, and run simple validation.
Out of scope: cloud purchase/upload/deploy APIs, silently changing the system trust store, submitting CA requests for the user.
0600; do not log key bodies.openssl (command -v openssl). keytool only for JKS.| Intent | Example asks |
|---|---|
| Inspect | validity dates, SAN, issuer |
| Match | are cert and key a pair; does CSR match |
| Generate CSR | create CSR to get a signed cert |
| Convert | PEM ↔ PFX/P12, split chain |
| Verify | chain OK, expired or not |
openssl version
openssl x509 -in <cert.pem> -noout -subject -issuer -dates -ext subjectAltName 2>/dev/null
openssl x509 -in <cert.pem> -noout -text | head -80
For PFX, ask for the password; prefer -passin env:CERT_PASS over putting secrets on the command line:
openssl pkcs12 -in <file.pfx> -nokeys -clcerts -passin env:CERT_PASS
Compare public keys (preferred) or RSA moduli. Each openssl extract must succeed and produce non-empty output before comparing:
openssl x509 - <cert.pem> -noout -pubkey | openssl md5
openssl pkey - <key.pem> -pubout | openssl md5
openssl req - <csr.pem> -noout -pubkey | openssl md5
Parse failure or empty digest → not MATCH. Equal non-empty digests → MATCH.
Optional: openssl req -in <csr.pem> -noout -verify (CSR signature; separate from key match).
Confirm CN/SAN, algorithm (default RSA 2048), and output directory.
openssl req -new -newkey rsa:2048 -nodes \
-keyout <domain>.key -out <domain>.csr \
-subj "/CN=<domain>"
openssl req -in <domain>.csr -noout -text | head -60
With SAN, write a temporary san.cnf (user confirms) then:
openssl req -new -newkey rsa:2048 -nodes \
-keyout <domain>.key -out <domain>.csr \
-config san.cnf -extensions v3_req
ECDSA:
openssl ecparam -genkey -name prime256v1 -out <domain>.key
openssl req -new -key <domain>.key -out <domain>.csr -subj "/CN=<domain>"
Remind: do not commit the private key; CSR can go to the CA.
Confirm inputs and target format first.
openssl pkcs12 -export -out <out.pfx> -inkey <key.pem> -in <cert.pem> [-certfile chain.pem]
openssl pkcs12 -in <in.pfx> -clcerts -nokeys -out cert.pem
openssl pkcs12 -in <in.pfx> -nocerts -nodes -out key.pem
openssl x509 -in <file> -noout -subject 2>/dev/null || openssl req -in <file> -noout -subject 2>/dev/null
Handle JKS only if the user asks and keytool exists; otherwise prefer PEM/PFX.
openssl x509 -in <cert.pem> -noout -checkend 0 && echo 'not expired' || echo 'expired or invalid'
openssl verify -CAfile <ca_or_chain.pem> <cert.pem>
Live site (read-only) when the user gives an HTTPS host:
echo | openssl s_client -connect <host>:443 -servername <host> 2>/dev/null | openssl x509 -noout -subject -dates
## Conclusion
What was done: inspect / match result / generated paths / conversion outputs.
## Evidence
- Relevant openssl output (redacted; no private key body)
- Digest comparison for match checks
## Recommendations
- Next steps (submit CSR, deploy where, `chmod 600`)
- Direction if expired or mismatched
Reply in the user's language.
| Case | Skill |
|---|---|
| Domain does not resolve | dns-diagnose |
| Network fails before TLS | network-path-diagnose |
User: Are server.crt and server.key a pair?