Certificate Inventory Audit
Find every certificate you trust — before someone else's compromise finds it
Audit every certificate chain and trust store your systems rely on: servers, apps, containers, and bundled libraries, so a compromised CA anywhere in your stack is a known line item, not a surprise.
Install it in 3 steps
No sign-up. No CLI tools. Pick your AI, copy one line, paste it over.
Prefer doing it yourself? Buy the skill ($4.99), download the ZIP from your checkout confirmation, unzip it into the directory shown above, restart your AI session — same result. Already bought it? Your AI assistant can download it for you.
What's inside
One SKILL.md (the playbook) + one starter template. A preview:
Certificate Inventory Audit
The lesson
In October 2026, eight eMudhra intermediate CAs turned out to have weak, recoverable private keys — keys so weak that one of them was literally the number 4. Browsers blocked them within hours. The danger was never mainly the browser: it was every non-browser client, container image, and bundled library that kept trusting those chains until its own software was updated. You cannot patch what you have not inventoried.
Workflow
- List trust stores, not just certificates (input: your estate -> output: a store list).
Enumerate every place trust lives: OS stores, browser stores, language
runtimes (Go, Python certifi, Node), container base images, appliances,
and libraries that bundle their own root copy. A store you forgot is
the one that stays vulnerable after the "all patched" announcement. - Map chains (input: certificates in use -> output: chain per service).
For each service, record the full chain: leaf, intermediates, root —
and which store each link is validated against. Flag any chain that
passes through an intermediate you did not choose and cannot name.
"Issued by a CA we have never heard of" is a finding, not trivia. - Check revocation and transparency behaviour (input: each store -> output: a behaviour table).
For each store, answer: does it consume revocation data (CRLSets,
OneCRL, OCSP)? Does it enforce Certificate Transparency? When does it
update, and who notices if an update fails? Clients that skip both are
your real exposure in any CA compromise — they keep trusting a revoked
intermediate until someone updates the bundle by hand. - Score and rank (input: chain map + behaviour table -> output: a ranked list).
Rank services by: (a) exposure (internet-facing first), (b) store
freshness (stale bundles first), (c) chain opacity (unknown
intermediates first). The top of the list is your patch order in the
next incident — write it down now, while nobody is in a hurry. - Re-run on a schedule (input: the inventory -> output: a dated re-audit).
Re-run quarterly and after any CA incident in the news. Diff the new
inventory against the old one; unexplained new chains are findings.
An inventory that is not re-run is a photograph, and photographs age.
What good looks like
A one-page-per-service inventory that lets you answer, within an hour of any CA compromise announcement: "are we exposed, where, and what do we update first?" If the answer takes a week of archaeology, the audit failed.
Template preview
Certificate Inventory Worksheet
1. Trust stores
2. Chain map (per service)
3. Revocation + CT behaviour
4. Patch order (ranked)
1. 2. 3.
