Certificate Check

Inputs

Workflow

1. Bootstrap

• persona_load("devops") — openssl, curl, nmap tools
• check_known_issues("openssl", ""), check_known_issues("certificate", "")

2. Certificate Checks (first endpoint)

• Parse host from endpoints.split(',')[0].strip()
• openssl_s_client(host="{host}") — TLS connection
• openssl_s_client_cert(host="{host}") — certificate details
• openssl_x509_info(host="{host}") — X.509 info
• openssl_x509_verify(host="{host}") — chain verification
• curl_headers(url="https://{host}") — HSTS and security headers
• nmap_scan(target="{host}") — TLS port
• nmap_script(target="{host}") — SSL scripts

3. Parse Certificate

• Extract: subject, issuer, expiry (Not After), days_left
• expiry_warning = days_left < warn_days
• chain_valid = "verify return code: 0" in verify output
• has_hsts = "strict-transport-security" in headers
• healthy = chain_valid and not expiry_warning and days_left > 0

4. InScope Lookup

• inscope_ask("How do I manage TLS certificates for {environment} environment?")

5. Report

• Certificate details table
• Health status
• Nmap SSL analysis
• Documentation snippet
• Log: memory_session_log("Certificate check on {endpoints}", "healthy={healthy}, days_left={days}")

6. Failure Learning

• Unable to get local issuer → learn_tool_fix("openssl_x509_verify", "unable to get local issuer", "Missing CA bundle", "Ensure system CA certs up to date")
• Certificate has expired → learn_tool_fix("openssl_s_client", "certificate has expired", "Cert expired", "Renew via cert-manager or manual")

Key MCP Tools

• persona_load, openssl_s_client, openssl_s_client_cert, openssl_x509_info, openssl_x509_verify
• curl_headers, nmap_scan, nmap_script
• inscope_ask, check_known_issues, learn_tool_fix, memory_session_log

Chains To

• security_audit