tls server config auditor

Audit nginx, Apache and HAProxy TLS configs and PEMs offline against Mozilla TLS guidelines 6.0, RFC 8996 and the CA/B 200/100/47-day schedule.

Audit nginx, Apache httpd and HAProxy TLS/HTTPS configuration files and PEM certificates offline against the bundled Mozilla Server Side TLS guidelines 6.0 (intermediate or modern), RFC 8996 and the CA/Browser Forum 200/100/47-day certificate lifetime schedule. Flags TLS 1.0/1.1, weak and CBC ciphers, OpenSSL keyword cipher strings, missing or short HSTS, small RSA keys, missing SANs, expiry and over-long lifetimes, and generates a corrected config snippet. Use when someone asks "is my SSL config secure?", "harden nginx TLS" or "why does my scanner flag TLS 1.0?".

What it does

• Runs entirely offline in standard-library Python (no network, no credentials, writes only inside the working folder).
• Ships with examples, unit tests (run on Python 3.8 / 3.9 / 3.13) and a references/sources.md citing the official specs used.
• Exit codes: 0 = clean / aligned, 1 = findings, 2 = bad input — ready for CI and agent loops.

Who it's for

Security-minded developers, MSPs, small-business IT, compliance leads and IR analysts who want a repeatable offline check their agent can run.

Not legal advice / limits

See the skill's references/sources.md and Known Limitations below. Compliance-flavored output is a draft for counsel, not a certification.