ssl-tls

Q: How do I install ssl-tls?

Run npx skills add https://github.com/chaterm/terminal-skills --skill ssl-tls in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/ssl-tls/ (personal) or .claude/skills/ssl-tls/ (project).

by chaterm

SSL/TLS 证书

Installs: 70
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/chaterm/terminal-skills --skill ssl-tls

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads ssl-tls automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

SSL/TLS 证书

概述

证书申请、配置、自动续期技能。

OpenSSL 基础

生成私钥

# RSA 私钥
openssl genrsa -out private.key 2048
openssl genrsa -out private.key 4096

# 带密码保护
openssl genrsa -aes256 -out private.key 2048

# ECDSA 私钥
openssl ecparam -genkey -name prime256v1 -out private.key

生成 CSR

# 交互式
openssl req -new -key private.key -out request.csr

# 非交互式
openssl req -new -key private.key -out request.csr \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=Company/CN=example.com"

# 带 SAN
openssl req -new -key private.key -out request.csr \
    -config <(cat <<EOF
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req

[req_distinguished_name]
CN = example.com

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = example.com
DNS.2 = www.example.com
DNS.3 = api.example.com
EOF
)

自签名证书

# 一步生成
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout private.key -out certificate.crt \
    -subj "/CN=example.com"

# 从已有私钥
openssl req -x509 -key private.key -days 365 -out certificate.crt

查看证书

# 查看证书信息
openssl x509 -in certificate.crt -text -noout

# 查看 CSR
openssl req -in request.csr -text -noout

# 查看私钥
openssl rsa -in private.key -text -noout

# 验证证书链
openssl verify -CAfile ca.crt certificate.crt

# 检查远程证书
openssl s_client -connect example.com:443 -servername example.com

格式转换

# PEM 转 DER
openssl x509 -in cert.pem -outform DER -out cert.der

# DER 转 PEM
openssl x509 -in cert.der -inform DER -out cert.pem

# PEM 转 PKCS12
openssl pkcs12 -export -out cert.p12 -inkey private.key -in cert.pem

# PKCS12 转 PEM
openssl pkcs12 -in cert.p12 -out cert.pem -nodes

Let's Encrypt

Certbot 安装

# Debian/Ubuntu
apt install certbot python3-certbot-nginx

# CentOS/RHEL
yum install certbot python3-certbot-nginx

申请证书

# Nginx 插件
certbot --nginx -d example.com -d www.example.com

# Apache 插件
certbot --apache -d example.com

# Standalone
certbot certonly --standalone -d example.com

# Webroot
certbot certonly --webroot -w /var/www/html -d example.com

# DNS 验证（通配符）
certbot certonly --manual --preferred-challenges dns -d "*.example.com"

管理证书

# 查看证书
certbot certificates

# 续期测试
certbot renew --dry-run

# 手动续期
certbot renew

# 删除证书
certbot delete --cert-name example.com

自动续期

# Cron
0 0 * * * certbot renew --quiet

# Systemd timer
systemctl enable certbot.timer
systemctl start certbot.timer

Nginx 配置

基础 HTTPS

server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
}

HTTP 重定向

server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

安全加固

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;

add_header Strict-Transport-Security "max-age=63072000" always;

常见场景

场景 1：创建 CA

# 生成 CA 私钥
openssl genrsa -out ca.key 4096

# 生成 CA 证书
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
    -out ca.crt -subj "/CN=My CA"

# 签发证书
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
    -CAcreateserial -out server.crt -days 365 -sha256

场景 2：检查证书过期

#!/bin/bash
DOMAIN=$1
DAYS=30

EXPIRY=$(echo | openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} 2>/dev/null | \
    openssl x509 -noout -enddate | cut -d= -f2)

EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s)
NOW_EPOCH=$(date +%s)
DIFF=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))

if [ $DIFF -lt $DAYS ]; then
    echo "WARNING: ${DOMAIN} 证书将在 ${DIFF} 天后过期"
fi

场景 3：批量续期

#!/bin/bash
certbot renew --deploy-hook "systemctl reload nginx"

故障排查

问题	排查方法
证书不信任	检查证书链、CA
域名不匹配	检查 CN、SAN
证书过期	检查有效期、续期
握手失败	检查协议、密码套件

# 测试 SSL
openssl s_client -connect example.com:443

# 检查证书链
openssl s_client -connect example.com:443 -showcerts

# SSL Labs 测试
curl https://api.ssllabs.com/api/v3/analyze?host=example.com

FAQ

What does the ssl-tls skill do?

SSL/TLS 证书

How do I install ssl-tls?

Run npx skills add https://github.com/chaterm/terminal-skills --skill ssl-tls in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/ssl-tls/ (personal) or .claude/skills/ssl-tls/ (project).

Which AI agents can use ssl-tls?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is ssl-tls safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains ssl-tls?

It is published by chaterm in chaterm/terminal-skills. It has 70 recorded installs.

Popular other skills

View category →

hyperframes-cli

heygen-com/hyperframes

The HyperFrames CLI by job - scaffold, check, look at frames, edit the timeline, preview, render locally or in the cloud, publish, project history - plus reading its JSON and recovering from build or render failures.

1.3M installs

triage

mattpocock/skills

Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.

1M installs

ask-matt

mattpocock/skills

Ask which skill or flow fits your situation. A router over the skills in this repo.

778.4K installs

to-questionnaire

mattpocock/skills

Turn a decision you can't fully answer into a questionnaire for someone else to fill in.

508.9K installs

wait-what

mattpocock/skills

Stop. That last message did not land: re-pitch it.

459.7K installs

loop-me

mattpocock/skills

Grill me about specs for the workflows I want to build, within this workspace.

447.9K installs

ssl-tls

Install

Install

Describe the task

Review the result

SKILL.md

SSL/TLS 证书

概述

OpenSSL 基础

生成私钥

生成 CSR

自签名证书

查看证书

格式转换

Let's Encrypt

Certbot 安装

申请证书

管理证书

自动续期

Nginx 配置

基础 HTTPS

HTTP 重定向

安全加固

常见场景

场景 1：创建 CA

场景 2：检查证书过期

场景 3：批量续期

故障排查

FAQ

More from chaterm/terminal-skills

Popular other skills