菜单
Local SSL/TLS certificate toolkit using openssl: inspect certificates, check key/cert/CSR match, generate CSRs, convert PEM/PFX, and run simple chain checks. No cloud certificate APIs. Also matches Chinese requests such as SSL 证书、 证书匹配、生成 CSR、转换证书格式、检查证书.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/AI-Shell-Team/aish --skill ssl-cert-toolkit命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | ssl-cert-toolkit |
| version | 1.0.0 |
| description | Local SSL/TLS certificate toolkit using openssl: inspect certificates, check key/cert/CSR match, generate CSRs, convert PEM/PFX, and run simple chain checks. No cloud certificate APIs. Also matches Chinese requests such as SSL 证书、 证书匹配、生成 CSR、转换证书格式、检查证书. |
| author | aish |
| allowed-tools | ["bash","read_file","grep","glob"] |
| triggers | ["ssl-cert-toolkit","SSL certificate","certificate match","check certificate","generate CSR","convert certificate","PEM PFX","openssl certificate","key cert match","SSL 证书","证书匹配","检查证书","生成 CSR","转换证书格式"] |
| platforms | ["linux"] |
| distributions | ["deepin","debian","ubuntu","uos"] |
Use openssl on this host to inspect certificates, verify key/cert/CSR pairing, generate CSRs, convert common formats, and run simple validation.
Out of scope: cloud purchase/upload/deploy APIs, silently changing the system trust store, submitting CA requests for the user.
0600; do not log key bodies.openssl (command -v openssl). keytool only for JKS.| Intent | Example asks |
|---|---|
| Inspect | validity dates, SAN, issuer |
| Match | are cert and key a pair; does CSR match |
| Generate CSR | create CSR to get a signed cert |
| Convert | PEM ↔ PFX/P12, split chain |
| Verify | chain OK, expired or not |
openssl version
openssl x509 -in <cert.pem> -noout -subject -issuer -dates -ext subjectAltName 2>/dev/null
openssl x509 -in <cert.pem> -noout -text | head -80
For PFX, ask for the password; prefer -passin env:CERT_PASS over putting secrets on the command line:
openssl pkcs12 -in <file.pfx> -nokeys -clcerts -passin env:CERT_PASS
Compare public keys (preferred) or RSA moduli. Each openssl extract must succeed and produce non-empty output before comparing:
openssl x509 - <cert.pem> -noout -pubkey | openssl md5
openssl pkey - <key.pem> -pubout | openssl md5
openssl req - <csr.pem> -noout -pubkey | openssl md5
Parse failure or empty digest → not MATCH. Equal non-empty digests → MATCH.
Optional: openssl req -in <csr.pem> -noout -verify (CSR signature; separate from key match).
Confirm CN/SAN, algorithm (default RSA 2048), and output directory.
openssl req -new -newkey rsa:2048 -nodes \
-keyout <domain>.key -out <domain>.csr \
-subj "/CN=<domain>"
openssl req -in <domain>.csr -noout -text | head -60
With SAN, write a temporary san.cnf (user confirms) then:
openssl req -new -newkey rsa:2048 -nodes \
-keyout <domain>.key -out <domain>.csr \
-config san.cnf -extensions v3_req
ECDSA:
openssl ecparam -genkey -name prime256v1 -out <domain>.key
openssl req -new -key <domain>.key -out <domain>.csr -subj "/CN=<domain>"
Remind: do not commit the private key; CSR can go to the CA.
Confirm inputs and target format first.
openssl pkcs12 -export -out <out.pfx> -inkey <key.pem> -in <cert.pem> [-certfile chain.pem]
openssl pkcs12 -in <in.pfx> -clcerts -nokeys -out cert.pem
openssl pkcs12 -in <in.pfx> -nocerts -nodes -out key.pem
openssl x509 -in <file> -noout -subject 2>/dev/null || openssl req -in <file> -noout -subject 2>/dev/null
Handle JKS only if the user asks and keytool exists; otherwise prefer PEM/PFX.
openssl x509 -in <cert.pem> -noout -checkend 0 && echo 'not expired' || echo 'expired or invalid'
openssl verify -CAfile <ca_or_chain.pem> <cert.pem>
Live site (read-only) when the user gives an HTTPS host:
echo | openssl s_client -connect <host>:443 -servername <host> 2>/dev/null | openssl x509 -noout -subject -dates
## Conclusion
What was done: inspect / match result / generated paths / conversion outputs.
## Evidence
- Relevant openssl output (redacted; no private key body)
- Digest comparison for match checks
## Recommendations
- Next steps (submit CSR, deploy where, `chmod 600`)
- Direction if expired or mismatched
Reply in the user's language.
| Case | Skill |
|---|---|
| Domain does not resolve | dns-diagnose |
| Network fails before TLS | network-path-diagnose |
User: Are server.crt and server.key a pair?