Automate SSL Certificate Management

This skill automates SSL certificate lifecycle management via the ACME protocol and Let's Encrypt, covering provisioning, renewal, monitoring, and multi-environment deployment. Certificates are provisioned and renewed automatically with at least 30 days of lead time before expiration, backed by health monitoring, alerting, an emergency-replacement procedure, and a certificate inventory. Every certificate uses strong keys (RSA 2048-bit or better, or ECDSA P-256 or better), rotated on a policy, with private keys stored under strict access control and every certificate operation logged for audit.

Use it when automating certificate issuance and renewal across HTTP-01 or DNS-01 ACME challenges, Kubernetes, load balancers, or containerized environments - not for a single manually-managed certificate. It is not meant to run without rate-limit awareness: Let's Encrypt limits to 50 certificates per domain per week, so testing should go through the staging environment and automation should back off exponentially on failed requests.

Given a domain, it produces HTTP-01 challenge automation (a certbot webroot flow that reloads nginx on renewal), DNS-01 wildcard automation (a Route53 TXT-record update via boto3, waiting for DNS propagation, driven by a certbot hook reading the domain and validation token from environment variables), scheduled renewal via a systemd timer (running twice daily with a randomized delay) or a Docker-based renewal job (certbot with the Route53 DNS plugin, syncing issued certificates to S3), a Kubernetes cert-manager ClusterIssuer and Certificate resource for wildcard and apex domains, and load-balancer integration (updating an ALB listener's certificate via boto3, plus a direct TLS socket check that reads the peer certificate's expiry date).

#!/bin/bash
### certificate-health-check.sh

CERT_DIR="/etc/letsencrypt/live"
WARN_DAYS=30
CRIT_DAYS=7
EXIT_CODE=0

for cert_path in "$CERT_DIR"/*; do
    if [ -d "$cert_path" ]; then
        domain=$(basename "$cert_path")
        cert_file="$cert_path/cert.pem"
        
        if [ -f "$cert_file" ]; then
            expiry_date=$(openssl x509 -enddate -noout -in "$cert_file" | cut -d= -f2)
            expiry_epoch=$(date -d "$expiry_date" +%s)
            current_epoch=$(date +%s)
            days_left=$(( (expiry_epoch - current_epoch) / 86400 ))
            
            if [ $days_left -lt $CRIT_DAYS ]; then
                echo "CRITICAL: Certificate for $domain expires in $days_left days"
                EXIT_CODE=2
            elif [ $days_left -lt $WARN_DAYS ]; then
                echo "WARNING: Certificate for $domain expires in $days_left days"
                EXIT_CODE=1
            else
                echo "OK: Certificate for $domain expires in $days_left days"
            fi
        fi
    fi
done

exit $EXIT_CODE

Monitoring feeds into Prometheus via a Gauge tracking days-until-expiry per domain and a Counter tracking renewal attempts by status, automatically triggering renewal once a certificate drops below 30 days remaining. Certificates issue through Route53 for DNS-01 validation, distribute via S3 or directly to an ALB listener, and can run inside a Kubernetes cluster through cert-manager.

Platform and security engineers automating TLS certificate management across cloud and containerized infrastructure who need real disaster-recovery discipline as well - offline backups of certificates and keys, documented and regularly-tested emergency replacement procedures, cross-region certificate replication, and hardware security modules for high-value certificates.