ssl-tls

Name: ssl-tls
Author: chaterm

58installs12forks

How to install ssl-tls?

chaterm/terminal-skills/ssl-tls

$npx -y skills add chaterm/terminal-skills --skill ssl-tls

Installs into the current project.

Summary

SSL/TLS 证书

Files · 1

View on GitHub

SKILL.md

1	# SSL/TLS 证书
2
3	## 概述
4	证书申请、配置、自动续期技能。
5
6	## OpenSSL 基础
7
8	### 生成私钥
9	```bash
10	# RSA 私钥
11	openssl genrsa -out private.key 2048
12	openssl genrsa -out private.key 4096
13
14	# 带密码保护
15	openssl genrsa -aes256 -out private.key 2048
16
17	# ECDSA 私钥
18	openssl ecparam -genkey -name prime256v1 -out private.key
19	```
20
21	### 生成 CSR
22	```bash
23	# 交互式
24	openssl req -new -key private.key -out request.csr
25
26	# 非交互式
27	openssl req -new -key private.key -out request.csr \
28	-subj "/C=CN/ST=Beijing/L=Beijing/O=Company/CN=example.com"
29
30	# 带 SAN
31	openssl req -new -key private.key -out request.csr \
32	-config <(cat <<EOF
33	[req]
34	distinguished_name = req_distinguished_name
35	req_extensions = v3_req
36
37	[req_distinguished_name]
38	CN = example.com
39
40	[v3_req]
41	subjectAltName = @alt_names
42
43	[alt_names]
44	DNS.1 = example.com
45	DNS.2 = www.example.com
46	DNS.3 = api.example.com
47	EOF
48	)
49	```
50
51	### 自签名证书
52	```bash
53	# 一步生成
54	openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
55	-keyout private.key -out certificate.crt \
56	-subj "/CN=example.com"
57
58	# 从已有私钥
59	openssl req -x509 -key private.key -days 365 -out certificate.crt
60	```
61
62	### 查看证书
63	```bash
64	# 查看证书信息
65	openssl x509 -in certificate.crt -text -noout
66
67	# 查看 CSR
68	openssl req -in request.csr -text -noout
69
70	# 查看私钥
71	openssl rsa -in private.key -text -noout
72
73	# 验证证书链
74	openssl verify -CAfile ca.crt certificate.crt
75
76	# 检查远程证书
77	openssl s_client -connect example.com:443 -servername example.com
78	```
79
80	### 格式转换
81	```bash
82	# PEM 转 DER
83	openssl x509 -in cert.pem -outform DER -out cert.der
84
85	# DER 转 PEM
86	openssl x509 -in cert.der -inform DER -out cert.pem
87
88	# PEM 转 PKCS12
89	openssl pkcs12 -export -out cert.p12 -inkey private.key -in cert.pem
90
91	# PKCS12 转 PEM
92	openssl pkcs12 -in cert.p12 -out cert.pem -nodes
93	```
94
95	## Let's Encrypt
96
97	### Certbot 安装
98	```bash
99	# Debian/Ubuntu
100	apt install certbot python3-certbot-nginx
101
102	# CentOS/RHEL
103	yum install certbot python3-certbot-nginx
104	```
105
106	### 申请证书
107	```bash
108	# Nginx 插件
109	certbot --nginx -d example.com -d www.example.com
110
111	# Apache 插件
112	certbot --apache -d example.com
113
114	# Standalone
115	certbot certonly --standalone -d example.com
116
117	# Webroot
118	certbot certonly --webroot -w /var/www/html -d example.com
119
120	# DNS 验证（通配符）
121	certbot certonly --manual --preferred-challenges dns -d "*.example.com"
122	```
123
124	### 管理证书
125	```bash
126	# 查看证书
127	certbot certificates
128
129	# 续期测试
130	certbot renew --dry-run
131
132	# 手动续期
133	certbot renew
134
135	# 删除证书
136	certbot delete --cert-name example.com
137	```
138
139	### 自动续期
140	```bash
141	# Cron
142	0 0 * * * certbot renew --quiet
143
144	# Systemd timer
145	systemctl enable certbot.timer
146	systemctl start certbot.timer
147	```
148
149	## Nginx 配置
150
151	### 基础 HTTPS
152	```nginx
153	server {
154	listen 443 ssl http2;
155	server_name example.com;
156
157	ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
158	ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
159
160	ssl_protocols TLSv1.2 TLSv1.3;
161	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
162	ssl_prefer_server_ciphers off;
163	}
164	```
165
166	### HTTP 重定向
167	```nginx
168	server {
169	listen 80;
170	server_name example.com;
171	return 301 https://$server_name$request_uri;
172	}
173	```
174
175	### 安全加固
176	```nginx
177	ssl_session_timeout 1d;
178	ssl_session_cache shared:SSL:50m;
179	ssl_session_tickets off;
180
181	ssl_stapling on;
182	ssl_stapling_verify on;
183	resolver 8.8.8.8 8.8.4.4 valid=300s;
184
185	add_header Strict-Transport-Security "max-age=63072000" always;
186	```
187
188	## 常见场景
189
190	### 场景 1：创建 CA
191	```bash
192	# 生成 CA 私钥
193	openssl genrsa -out ca.key 4096
194
195	# 生成 CA 证书
196	openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
197	-out ca.crt -subj "/CN=My CA"
198
199	# 签发证书
200	openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
201	-CAcreateserial -out server.crt -days 365 -sha256
202	```
203
204	### 场景 2：检查证书过期
205	```bash
206	#!/bin/bash
207	DOMAIN=$1
208	DAYS=30
209
210	EXPIRY=$(echo \| openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} 2>/dev/null \| \
211	openssl x509 -noout -enddate \| cut -d= -f2)
212
213	EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s)
214	NOW_EPOCH=$(date +%s)
215	DIFF=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))
216
217	if [ $DIFF -lt $DAYS ]; then
218	echo "WARNING: ${DOMAIN} 证书将在 ${DIFF} 天后过期"
219	fi
220	```
221
222	### 场景 3：批量续期
223	```bash
224	#!/bin/bash
225	certbot renew --deploy-hook "systemctl reload nginx"
226	```
227
228	## 故障排查
229
230	\| 问题 \| 排查方法 \|
231	\|------\|----------\|
232	\| 证书不信任 \| 检查证书链、CA \|
233	\| 域名不匹配 \| 检查 CN、SAN \|
234	\| 证书过期 \| 检查有效期、续期 \|
235	\| 握手失败 \| 检查协议、密码套件 \|
236
237	```bash
238	# 测试 SSL
239	openssl s_client -connect example.com:443
240
241	# 检查证书链
242	openssl s_client -connect example.com:443 -showcerts
243
244	# SSL Labs 测试
245	curl https://api.ssllabs.com/api/v3/analyze?host=example.com
246	```

People who liked this also viewed

6 picks

Type

microsoft-foundryDeploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffoSkillsJul 2026476k1.3k
azure-deployExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application SkillsJul 2026472k1.3k
azure-preparePrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wSkillsJul 2026471k1.3k
azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pSkillsJul 2026471k1.3k
azure-aigatewayConfigure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbSkillsJul 2026470k1.3k
azure-hosted-copilot-sdkOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026424k1.3k

ssl-tls

58installs12forks

View on GitHub

How to install ssl-tls?

chaterm/terminal-skills/ssl-tls

$npx -y skills add chaterm/terminal-skills --skill ssl-tls

Installs into the current project.

Summary

SSL/TLS 证书

Files · 1

View on GitHub

SKILL.md

1	# SSL/TLS 证书
2
3	## 概述
4	证书申请、配置、自动续期技能。
5
6	## OpenSSL 基础
7
8	### 生成私钥
9	```bash
10	# RSA 私钥
11	openssl genrsa -out private.key 2048
12	openssl genrsa -out private.key 4096
13
14	# 带密码保护
15	openssl genrsa -aes256 -out private.key 2048
16
17	# ECDSA 私钥
18	openssl ecparam -genkey -name prime256v1 -out private.key
19	```
20
21	### 生成 CSR
22	```bash
23	# 交互式
24	openssl req -new -key private.key -out request.csr
25
26	# 非交互式
27	openssl req -new -key private.key -out request.csr \
28	-subj "/C=CN/ST=Beijing/L=Beijing/O=Company/CN=example.com"
29
30	# 带 SAN
31	openssl req -new -key private.key -out request.csr \
32	-config <(cat <<EOF
33	[req]
34	distinguished_name = req_distinguished_name
35	req_extensions = v3_req
36
37	[req_distinguished_name]
38	CN = example.com
39
40	[v3_req]
41	subjectAltName = @alt_names
42
43	[alt_names]
44	DNS.1 = example.com
45	DNS.2 = www.example.com
46	DNS.3 = api.example.com
47	EOF
48	)
49	```
50
51	### 自签名证书
52	```bash
53	# 一步生成
54	openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
55	-keyout private.key -out certificate.crt \
56	-subj "/CN=example.com"
57
58	# 从已有私钥
59	openssl req -x509 -key private.key -days 365 -out certificate.crt
60	```
61
62	### 查看证书
63	```bash
64	# 查看证书信息
65	openssl x509 -in certificate.crt -text -noout
66
67	# 查看 CSR
68	openssl req -in request.csr -text -noout
69
70	# 查看私钥
71	openssl rsa -in private.key -text -noout
72
73	# 验证证书链
74	openssl verify -CAfile ca.crt certificate.crt
75
76	# 检查远程证书
77	openssl s_client -connect example.com:443 -servername example.com
78	```
79
80	### 格式转换
81	```bash
82	# PEM 转 DER
83	openssl x509 -in cert.pem -outform DER -out cert.der
84
85	# DER 转 PEM
86	openssl x509 -in cert.der -inform DER -out cert.pem
87
88	# PEM 转 PKCS12
89	openssl pkcs12 -export -out cert.p12 -inkey private.key -in cert.pem
90
91	# PKCS12 转 PEM
92	openssl pkcs12 -in cert.p12 -out cert.pem -nodes
93	```
94
95	## Let's Encrypt
96
97	### Certbot 安装
98	```bash
99	# Debian/Ubuntu
100	apt install certbot python3-certbot-nginx
101
102	# CentOS/RHEL
103	yum install certbot python3-certbot-nginx
104	```
105
106	### 申请证书
107	```bash
108	# Nginx 插件
109	certbot --nginx -d example.com -d www.example.com
110
111	# Apache 插件
112	certbot --apache -d example.com
113
114	# Standalone
115	certbot certonly --standalone -d example.com
116
117	# Webroot
118	certbot certonly --webroot -w /var/www/html -d example.com
119
120	# DNS 验证（通配符）
121	certbot certonly --manual --preferred-challenges dns -d "*.example.com"
122	```
123
124	### 管理证书
125	```bash
126	# 查看证书
127	certbot certificates
128
129	# 续期测试
130	certbot renew --dry-run
131
132	# 手动续期
133	certbot renew
134
135	# 删除证书
136	certbot delete --cert-name example.com
137	```
138
139	### 自动续期
140	```bash
141	# Cron
142	0 0 * * * certbot renew --quiet
143
144	# Systemd timer
145	systemctl enable certbot.timer
146	systemctl start certbot.timer
147	```
148
149	## Nginx 配置
150
151	### 基础 HTTPS
152	```nginx
153	server {
154	listen 443 ssl http2;
155	server_name example.com;
156
157	ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
158	ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
159
160	ssl_protocols TLSv1.2 TLSv1.3;
161	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
162	ssl_prefer_server_ciphers off;
163	}
164	```
165
166	### HTTP 重定向
167	```nginx
168	server {
169	listen 80;
170	server_name example.com;
171	return 301 https://$server_name$request_uri;
172	}
173	```
174
175	### 安全加固
176	```nginx
177	ssl_session_timeout 1d;
178	ssl_session_cache shared:SSL:50m;
179	ssl_session_tickets off;
180
181	ssl_stapling on;
182	ssl_stapling_verify on;
183	resolver 8.8.8.8 8.8.4.4 valid=300s;
184
185	add_header Strict-Transport-Security "max-age=63072000" always;
186	```
187
188	## 常见场景
189
190	### 场景 1：创建 CA
191	```bash
192	# 生成 CA 私钥
193	openssl genrsa -out ca.key 4096
194
195	# 生成 CA 证书
196	openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
197	-out ca.crt -subj "/CN=My CA"
198
199	# 签发证书
200	openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
201	-CAcreateserial -out server.crt -days 365 -sha256
202	```
203
204	### 场景 2：检查证书过期
205	```bash
206	#!/bin/bash
207	DOMAIN=$1
208	DAYS=30
209
210	EXPIRY=$(echo \| openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} 2>/dev/null \| \
211	openssl x509 -noout -enddate \| cut -d= -f2)
212
213	EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s)
214	NOW_EPOCH=$(date +%s)
215	DIFF=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))
216
217	if [ $DIFF -lt $DAYS ]; then
218	echo "WARNING: ${DOMAIN} 证书将在 ${DIFF} 天后过期"
219	fi
220	```
221
222	### 场景 3：批量续期
223	```bash
224	#!/bin/bash
225	certbot renew --deploy-hook "systemctl reload nginx"
226	```
227
228	## 故障排查
229
230	\| 问题 \| 排查方法 \|
231	\|------\|----------\|
232	\| 证书不信任 \| 检查证书链、CA \|
233	\| 域名不匹配 \| 检查 CN、SAN \|
234	\| 证书过期 \| 检查有效期、续期 \|
235	\| 握手失败 \| 检查协议、密码套件 \|
236
237	```bash
238	# 测试 SSL
239	openssl s_client -connect example.com:443
240
241	# 检查证书链
242	openssl s_client -connect example.com:443 -showcerts
243
244	# SSL Labs 测试
245	curl https://api.ssllabs.com/api/v3/analyze?host=example.com
246	```

People who liked this also viewed

6 picks

Type