SSL Cert Rotation Checker

What this skill does

Connects to a list of domains, retrieves each TLS certificate, and reports expiry date, days remaining, issuer, signature algorithm, and any chain validation issues. Output includes a calendar of upcoming renewals.

Inputs

• domains_file: a text file with one host[:port] per line. Default port 443.
• Optional warning_days: alert if a cert expires within this window (default 30).
• Optional concurrency: defaults to 16.

Steps

1. Read domains_file, drop blank lines and comments (#).
2. For each domain, run echo | openssl s_client -servername <host> -connect <host>:<port> -showcerts 2>/dev/null to fetch the chain.
3. Parse the leaf cert with openssl x509 -noout -dates -issuer -subject -fingerprint -sha256.
4. Convert notAfter to ISO 8601 and compute days_remaining = (notAfter - now) / 86400.
5. Inspect chain validity with openssl verify -CAfile <system bundle>; record any error N at depth M.
6. Detect weak signature algorithms (sha1WithRSAEncryption -> warning).
7. Cross-reference issuer for upcoming Let's Encrypt rotations: certs issued by Let's Encrypt R3 etc. should auto-rotate, so flag a manual rotation requirement only for non-LE issuers.
8. For each domain, classify: expired (< 0 days), critical (< warning_days), ok.
9. Write a markdown report with a sortable table and a "Next 30 days" calendar.

Output

ssl-rotation-report.md with: summary header (counts per class), table sorted by days_remaining ascending, calendar (week-bucketed list of domains expiring soon), and an Issues section for chain failures. Plus a ssl-rotation.csv sidecar.

Verification

Re-fetch a sample of three domains using curl --verbose https://<host> 2>&1 | grep 'expire date' and confirm dates match within a day (timezone differences). Trigger a synthetic test: rotate a known cert in staging and rerun the check; the report's notBefore should advance. If the script can't connect (timeout, refused), classify the row unreachable rather than skip silently.

Edge cases

• Domain behind SNI-required load balancer: always pass -servername.
• Wildcard certs: report once per leaf cert, not per matched subdomain.
• Multi-SAN certs: include all SANs in the report so people can search by either.
• Self-signed or private-CA certs: validation will fail by default; allow a --ca-bundle override and tag rows private-ca.