Does it connect to my CAs or websites?

No. It only parses certificate files you provide.

What is CAB_VALIDITY_GT_200?

CA/Browser Forum BR 2.3.1: subscriber certs issued on/after 2026-03-15 must not exceed 200 days.

Can I get calendar reminders?

Yes — `--ics renewals.ics` with `--warn-days 30`.

Are private keys required?

No. Only CERTIFICATE blocks are read; keys are ignored.

What about .p12 files?

Export to PEM first (`openssl pkcs12 -in file.p12 -nokeys -out file.pem`).

certificate inventory and expiry tracker

Example session with this skill installed

Here's our ./certs folder from the load balancer and a few app nodes. What expires in the next 30 days? Anything weak?

Read your context and instructions
Compiled the certificate inventory
Generated the data export

Answer: 5 certificates — 1 expired, 1 within the 30-day warn window, 1 weak key.

DAYS     NOT_AFTER              SUBJECT/SAN                  KEY        FLAGS
EXPIRED  2025-06-01T00:00:00    DNS:old.example.com          RSA2048    EXPIRED
7        2026-10-19T09:10:41    DNS:api.example.com          RSA2048    EXPIRES_14D
45       2026-11-26T09:10:41    DNS:shop.example.com         RSA2048    EXPIRES_60D
90       2027-01-10T09:10:41    DNS:legacy.example.com       RSA1024    RSA_LT_2048
180      2027-04-10T09:10:41    DNS:cdn.example.com          EC-P-256   -

Also flags SHA-1 signatures, CA/B Forum over-long validity (398 days before 2026-03-15;

200 days on/after per BR 2.3.1), and missing SANs.

Deliverables: sorted inventory table, certs.csv, certs.json, and renewals.ics with a display alarm --warn-days before each expiry (default 30).

Next steps: renew api.example.com this week; replace the RSA-1024 cert; import the .ics into the team calendar. Offline only — no AIA/OCSP/CRL fetches.

(Real run on bundled examples/certs/.)

certs.csv

CSV · data export

Generated

Example file from a real run - the skill writes it into your workspace.

Connects securely to your tools. The creator never sees your data.

About this skill

Never miss a certificate expiry again — from the files you already have.

Scan folders of PEM/CRT/CER/DER certificates. Get subject, SANs, issuer, key type/size, signature algorithm, days to expiry, weak-cert flags (SHA-1, RSA<2048, over-long CA/B validity) and an .ics renewal calendar. Pure offline parse — no AIA/OCSP/CRL fetches.

What's included

SKILL.md, scripts/certinv.py, sample certs, references (RFC 5280, CA/B BR 2.3.1 validity schedule).

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

Money-back guarantee

Doesn't do what its page promises? You get your money back.

certificate inventory and expiry tracker