Secure Communications with TLS/SSL Expertise

This is a TLS/SSL certificate management skill covering certificate types (Domain Validated, Organization Validated, Extended Validation, Wildcard, Multi-Domain/SAN, and self-signed for dev/test only), key security baselines (TLS 1.2 minimum with TLS 1.3 preferred, RSA 2048-bit minimum with ECDSA P-256 preferred, AEAD cipher suites, Perfect Forward Secrecy, HSTS, and certificate-transparency monitoring), certificate generation via OpenSSL (private key and CSR with SAN extensions) or Let's Encrypt/Certbot (webroot and DNS-challenge wildcard issuance, plus a cron-based auto-renewal job), and web-server configuration for both Nginx and Apache with matching modern cipher suites and security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy). It includes a working certificate-expiry monitoring script:

#!/bin/bash
### cert-monitor.sh - Monitor certificate expiration

DOMAINS=("example.com" "api.example.com" "admin.example.com")
WARN_DAYS=30
CRIT_DAYS=7

for domain in "${DOMAINS[@]}"; do
    expiry_date=$(echo | openssl s_client -servername $domain -connect $domain:443 2>/dev/null | 
                  openssl x509 -noout -dates | grep notAfter | cut -d= -f2)
    
    expiry_epoch=$(date -d "$expiry_date" +%s)
    current_epoch=$(date +%s)
    days_until_expiry=$(( (expiry_epoch - current_epoch) / 86400 ))
    
    if [ $days_until_expiry -le $CRIT_DAYS ]; then
        echo "CRITICAL: $domain expires in $days_until_expiry days!"
        # Send alert (email, Slack, etc.)
    elif [ $days_until_expiry -le $WARN_DAYS ]; then
        echo "WARNING: $domain expires in $days_until_expiry days"
    fi
done

Use this skill when setting up or hardening TLS on a web server, application, or containerized deployment - it gives concrete configuration blocks for Nginx, Apache, a Node.js HTTPS server, and Docker or Docker Compose SSL termination (including a certbot sidecar container), plus command-line validation steps (openssl s_client, openssl x509 -text, chain verification with openssl verify, and forcing a specific TLS version) and named external scanners (SSL Labs, testssl.sh) for independent verification. It explicitly recommends certificate rotation every 90 days for Let's Encrypt certificates and warns self-signed certificates are for development and testing only, never production. It is not a general application-security skill - it's scoped specifically to transport-layer encryption setup and certificate lifecycle management, so it isn't the right tool for application-layer vulnerabilities or authentication logic.

Input is the domain or domains needing TLS and the target platform - bare server, Nginx/Apache, Node.js, or Docker; output is generated key and CSR material, an issued certificate (self-signed, Let's Encrypt, or CA-issued), platform-specific TLS configuration blocks with modern cipher suites and security headers, an auto-renewal cron entry, and a monitoring script that flags certificates within a warning (30-day) or critical (7-day) window of expiry.

Built on OpenSSL for key and CSR generation and validation, Let's Encrypt/Certbot for automated issuance and renewal, Nginx and Apache for web-server TLS termination, Node.js's built-in https module for application-level TLS, and Docker/Docker Compose for containerized SSL termination with a certbot sidecar.

Infrastructure and platform engineers setting up or auditing TLS/SSL across bare servers, web servers, Node.js applications, or containers, who want platform-specific modern-cipher configurations and an automated renewal and monitoring setup, rather than reasoning about TLS parameters from scratch per deployment.