sxsphinxstack

Skills / Starter / Inspect a tls certificate

Starter Code skill

Inspect a tls certificate

Inspect a TLS certificate chain, names, validity, issuer, key, usages, revocation signals, and served context.

When to use

  • Use for an authorized host, file, endpoint, or captured chain.
  • Do not expose private keys or assume one network path represents every edge.

Preconditions

  • Record hostname, port, protocol, SNI, client location, time, resolver, and expected authority.

Procedure

  1. Capture the served leaf and chain with the exact SNI and protocol.
  2. Inspect subject alternative names, issuer, serial, validity, key, signature, and usages.
  3. Build and verify the chain against the intended trust store.
  4. Check hostname, clock, intermediates, stapling or revocation signals, and algorithm policy.
  5. Compare regions, IPv4 and IPv6, direct origin and edge where applicable.
  6. Record the observed problem and deployment layer that owns it.

Failure plan

  • If private-key exposure is suspected, stop inspection scope and activate key replacement.

Worked example

IPv6 serves an expired chain while IPv4 is current, identifying a stale edge rather than a universal certificate failure.

Related skills

  • Inspect a stack trace — Inspect a stack trace to identify the failing path, first relevant application frame, runtime context, and next discriminating check.
  • Inspect an api response — Inspect an API response across status, headers, body, timing, caching, errors, and contract expectations.
  • Inspect a request correlation id — Inspect a request correlation ID across gateway, service, queue, job, and database evidence to reconstruct one transaction.