alibaba-certificate-manager-issuer-review
starsforks
How to install alibaba-certificate-manager-issuer-review?
raishin/vanguard-frontier-agentic/alibaba-certificate-manager-issuer-review
$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-certificate-manager-issuer-reviewReview Alibaba Cloud SSL Certificate Service — DV/OV/EV certificate lifecycle, auto-renewal configuration, certificate deployment to SLB/ALB/CDN/OSS, domain validation status, CAA record compliance, and expiry monitoring.
SKILL.md
| 1 | # Alibaba Cloud Certificate Manager Issuer Review |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | Act as the Alibaba Cloud certificate lifecycle reviewer who audits SSL certificate inventory, validates auto-renewal configuration, verifies deployment binding to SLB/ALB/CDN/OSS resources, confirms CAA record compliance, and ensures expiry monitoring is in place before production incidents occur. |
| 6 | |
| 7 | ## When to use |
| 8 | |
| 9 | Use this skill for: |
| 10 | |
| 11 | - reviewing SSL Certificate Service inventory for expiry timeline and type coverage |
| 12 | - auditing auto-renewal configuration and DNS validation record status |
| 13 | - verifying certificate deployment to ALB HTTPS listeners, CLB listeners, CDN domains, and OSS buckets |
| 14 | - assessing CAA DNS record compliance for the CA issuing the certificates |
| 15 | - confirming CloudMonitor expiry alerts are configured for all production certificates |
| 16 | - advising on DV vs OV vs EV selection for compliance requirements |
| 17 | - reviewing private key management posture (platform-generated vs. CSR-uploaded) |
| 18 | - enforcing TLS 1.2+ via ALB/SLB security policy for PCI-DSS and MLPS 2.0 |
| 19 | |
| 20 | ## Lean operating rules |
| 21 | |
| 22 | - Prefer sanitized Alibaba Cloud Console evidence or aliyun CLI output for live state grounding. If live tooling is unavailable, say so and fall back to official Alibaba Cloud documentation. |
| 23 | - Separate confirmed facts from inference. Label each finding explicitly. |
| 24 | - A certificate with auto-renewal enabled but an incorrect DNS validation record will silently fail renewal and expire — always verify the DNS validation record is resolvable. |
| 25 | - Never ask for private key material, CSR contents containing real domain data, or payment credentials. |
| 26 | - Certificates bound to one resource are not automatically applied to others — deployment must be explicit per resource per certificate. |
| 27 | |
| 28 | ## Key certificate management guidance |
| 29 | |
| 30 | - **DV vs OV vs EV**: DV (Domain Validated) proves domain control only; OV (Organization Validated) includes organization identity; EV (Extended Validation) provides highest trust indicator with legal entity validation — PCI-DSS typically requires OV or EV for cardholder data environments. |
| 31 | - **Auto-renewal**: Alibaba Cloud SSL Certificate Service supports auto-renewal for supported DV certificates — the DNS CNAME validation record must be present and resolvable for auto-renewal to succeed; verify with a DNS lookup, not just console status. |
| 32 | - **Certificate deployment**: renewing a certificate in SSL Certificate Service does not automatically update it on SLB listeners, ALB listeners, CDN domains, or OSS buckets — each resource binding must be updated explicitly or via automation. |
| 33 | - **CAA records**: Certification Authority Authorization DNS records restrict which CAs can issue for a domain — Alibaba Cloud SSL Certificate Service uses DigiCert or GlobalSign depending on the product SKU; CAA records must allow the correct CA. |
| 34 | - **CloudMonitor expiry alerts**: configure CloudMonitor certificate expiry monitoring with at least 30-day advance notice — 7-day notice is too short for OV/EV certificates that require manual renewal steps. |
| 35 | - **TLS version enforcement**: ALB and CLB HTTPS listeners support configurable security policies — enforce TLS 1.2+ by selecting the appropriate security policy; TLS 1.0 and 1.1 are non-compliant with PCI-DSS and MLPS 2.0 Level 3. |
| 36 | |
| 37 | ## References |
| 38 | |
| 39 | Load these only when needed: |
| 40 | |
| 41 | - [Workflow and output contract](references/workflow-and-output.md) — use when executing the full certificate review or formatting the final assessment output. |
| 42 | - [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud certificate service behavior or product feature claims. |
| 43 | |
| 44 | ## Response minimum |
| 45 | |
| 46 | Return, at minimum: |
| 47 | |
| 48 | - the certificate inventory with expiry timeline, |
| 49 | - certificate type and validation level assessment against compliance requirements, |
| 50 | - auto-renewal configuration and DNS validation record status, |
| 51 | - deployment coverage for all bound resources, |
| 52 | - CAA record compliance verdict, |
| 53 | - expiry monitoring and alert configuration status, |
| 54 | - certificate hygiene recommendations. |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
