Certificate Inventory Audit

Find every certificate you trust — before someone else's compromise finds it

Audit every certificate chain and trust store your systems rely on: servers, apps, containers, and bundled libraries, so a compromised CA anywhere in your stack is a known line item, not a surprise.

こんな方におすすめ

Sysadmins, platform teams, security engineers

所要時間

~1 day per estate

レベル

中級

3ステップでインストール

登録不要。CLIツールも不要です。お使いのAIを選んで、1行コピーして貼るだけです。

Pro — 全511件のスキル

ご自分で入れたい場合は、スキルを購入（$4.99）し、購入完了画面からZIPをダウンロードして、上のディレクトリに展開し、AIのセッションを再起動してください。結果は同じです。すでに購入済みの場合は、AIアシスタントにダウンロードしてもらうこともできます。

パックの内容

SKILL.md（手順書）1点とスターターテンプレート1点が入っています。プレビューはこちらです：

Certificate Inventory Audit

The lesson

In October 2026, eight eMudhra intermediate CAs turned out to have weak, recoverable private keys — keys so weak that one of them was literally the number 4. Browsers blocked them within hours. The danger was never mainly the browser: it was every non-browser client, container image, and bundled library that kept trusting those chains until its own software was updated. You cannot patch what you have not inventoried.

Workflow

List trust stores, not just certificates (input: your estate -> output: a store list).
Enumerate every place trust lives: OS stores, browser stores, language
runtimes (Go, Python certifi, Node), container base images, appliances,
and libraries that bundle their own root copy. A store you forgot is
the one that stays vulnerable after the "all patched" announcement.
Map chains (input: certificates in use -> output: chain per service).
For each service, record the full chain: leaf, intermediates, root —
and which store each link is validated against. Flag any chain that
passes through an intermediate you did not choose and cannot name.
"Issued by a CA we have never heard of" is a finding, not trivia.
Check revocation and transparency behaviour (input: each store -> output: a behaviour table).
For each store, answer: does it consume revocation data (CRLSets,
OneCRL, OCSP)? Does it enforce Certificate Transparency? When does it
update, and who notices if an update fails? Clients that skip both are
your real exposure in any CA compromise — they keep trusting a revoked
intermediate until someone updates the bundle by hand.
Score and rank (input: chain map + behaviour table -> output: a ranked list).
Rank services by: (a) exposure (internet-facing first), (b) store
freshness (stale bundles first), (c) chain opacity (unknown
intermediates first). The top of the list is your patch order in the
next incident — write it down now, while nobody is in a hurry.
Re-run on a schedule (input: the inventory -> output: a dated re-audit).
Re-run quarterly and after any CA incident in the news. Diff the new
inventory against the old one; unexplained new chains are findings.
An inventory that is not re-run is a photograph, and photographs age.

What good looks like

A one-page-per-service inventory that lets you answer, within an hour of any CA compromise announcement: "are we exposed, where, and what do we update first?" If the answer takes a week of archaeology, the audit failed.