Certificate Inventory Audit
Find every certificate you trust — before someone else's compromise finds it
Audit every certificate chain and trust store your systems rely on: servers, apps, containers, and bundled libraries, so a compromised CA anywhere in your stack is a known line item, not a surprise.
In 3 Schritten installieren
Keine Anmeldung. Keine CLI-Tools. Wählen Sie Ihre AI, kopieren Sie eine Zeile und fügen Sie sie ein.
Lieber selbst machen? Kaufen Sie den Skill ($4.99), laden Sie die ZIP-Datei aus Ihrer Kaufbestätigung herunter, entpacken Sie sie in das oben angezeigte Verzeichnis und starten Sie Ihre AI-Sitzung neu — gleiches Ergebnis. Haben Sie ihn schon gekauft? Ihr AI-Assistent kann ihn für Sie herunterladen.
Was ist enthalten
Eine SKILL.md (die Anleitung) + eine Startvorlage. Eine Vorschau:
Certificate Inventory Audit
The lesson
In October 2026, eight eMudhra intermediate CAs turned out to have weak, recoverable private keys — keys so weak that one of them was literally the number 4. Browsers blocked them within hours. The danger was never mainly the browser: it was every non-browser client, container image, and bundled library that kept trusting those chains until its own software was updated. You cannot patch what you have not inventoried.
Workflow
- List trust stores, not just certificates (input: your estate -> output: a store list).
Enumerate every place trust lives: OS stores, browser stores, language
runtimes (Go, Python certifi, Node), container base images, appliances,
and libraries that bundle their own root copy. A store you forgot is
the one that stays vulnerable after the "all patched" announcement. - Map chains (input: certificates in use -> output: chain per service).
For each service, record the full chain: leaf, intermediates, root —
and which store each link is validated against. Flag any chain that
passes through an intermediate you did not choose and cannot name.
"Issued by a CA we have never heard of" is a finding, not trivia. - Check revocation and transparency behaviour (input: each store -> output: a behaviour table).
For each store, answer: does it consume revocation data (CRLSets,
OneCRL, OCSP)? Does it enforce Certificate Transparency? When does it
update, and who notices if an update fails? Clients that skip both are
your real exposure in any CA compromise — they keep trusting a revoked
intermediate until someone updates the bundle by hand. - Score and rank (input: chain map + behaviour table -> output: a ranked list).
Rank services by: (a) exposure (internet-facing first), (b) store
freshness (stale bundles first), (c) chain opacity (unknown
intermediates first). The top of the list is your patch order in the
next incident — write it down now, while nobody is in a hurry. - Re-run on a schedule (input: the inventory -> output: a dated re-audit).
Re-run quarterly and after any CA incident in the news. Diff the new
inventory against the old one; unexplained new chains are findings.
An inventory that is not re-run is a photograph, and photographs age.
What good looks like
A one-page-per-service inventory that lets you answer, within an hour of any CA compromise announcement: "are we exposed, where, and what do we update first?" If the answer takes a week of archaeology, the audit failed.
Vorschau der Startvorlage
Certificate Inventory Worksheet
1. Trust stores
2. Chain map (per service)
3. Revocation + CT behaviour
4. Patch order (ranked)
1. 2. 3.
Das Skill-Paket selbst (SKILL.md + Vorlage) ist auf Englisch verfasst.
