Tls Certificates

TLS & Certificates Skill

A skill for working with X.509 certificates, parsing certificate data, converting between formats, and identifying common security issues.

When to use this skill

Use this skill when the user:

• Needs to parse or inspect a certificate file
• Wants to convert between certificate formats (PEM, DER, PKCS#7, PKCS#12)
• Is investigating certificate-related security issues
• Needs to understand certificate fields and their meaning
• Is working with TLS/SSL configurations
• Wants to check certificate validity or trust chains

Quick certificate parsing

To inspect a certificate, use these commands:

# Full certificate details
openssl x509 -in cert.pem -noout -text

# ASN.1 structure parsing
openssl asn1parse -in cert.pem

Key fields to inspect

When analyzing a certificate, always check these fields:

Certificate formats

PEM

• Base64-encoded with -----BEGIN CERTIFICATE----- headers
• Text format, human-readable
• Common extensions: .pem, .crt, .cer

DER

• Binary ASN.1 encoding
• Smaller than PEM, not human-readable
• Common extension: .der

PKCS#7 (.p7b)

• Certificate chain (multiple certificates)
• Does NOT include private key
• Used for distributing certificate chains

PKCS#12 (.pfx, .p12)

• Certificate + private key + chain
• Password-protected
• Used for importing/exporting certificates with keys

Format conversions

PEM to DER

openssl x509 -in cert.pem -outform DER -out cert.der

DER to PEM

openssl x509 -in cert.der -inform DER -outform PEM -out cert.pem

PKCS#12 to PEM (extract cert and key)

openssl pkcs12 -in file.pfx -out out.pem -nodes

PKCS#7 to PEM (extract certificates)

openssl pkcs7 -in file.p7b -print_certs -out certs.pem

Convert .cer to PEM

openssl x509 -in cert.cer -outform PEM -out cert.pem

Common security issues to check

When reviewing certificates, look for these red flags:

1. Weak signature algorithms

• MD5: Completely broken, never use
• SHA1: Deprecated, avoid
• SHA256+: Current standard

2. Missing chain validation

• Certificate should chain to a trusted root
• Self-signed certificates need explicit trust
• Check if intermediate CAs are present

3. Name constraint violations

• SAN should match the intended domain
• Wildcard certificates (*.example.com) only match one subdomain level
• Implementation-specific parsing bugs may exist

4. Confused deputy issues

• Client certificate authentication may be misbound
• Ensure the certificate is actually being used for authentication
• Check for proper binding between certificate and session

5. Basic constraints issues

• End-entity certificates should have CA:FALSE
• CA certificates should have CA:TRUE and proper path length constraints

Certificate transparency

Check if a certificate has been logged in CT logs:

• Visit crt.sh and search by domain
• This shows all certificates ever issued for a domain
• Useful for detecting unauthorized certificate issuance

Example workflow

User: "I have this certificate file and need to understand what it's for"

You should:

1. Parse the certificate with openssl x509 -in cert.pem -noout -text
2. Extract and explain the key fields (Subject, Issuer, SAN, Validity, Key Usage)
3. Check for any security concerns (weak algorithms, expired, self-signed)
4. Suggest next steps based on the findings

User: "Convert this .pfx file to something I can use"

You should:

1. Ask if they need the private key extracted
2. Use openssl pkcs12 -in file.pfx -out out.pem -nodes to extract
3. Explain the output (separate cert and key files)
4. Remind them to protect the private key

Tools you'll need

• openssl - Required for all certificate operations
• openssl version 1.1.1 or 3.x recommended for full feature support

Common pitfalls

1. File format confusion: If a command fails, try specifying -inform DER or -inform PEM explicitly
2. PKCS#12 passwords: You'll be prompted for the import password
3. Private key protection: Never share private keys; use -nodes only when you need the unencrypted key
4. Chain order: When building chains, order matters (leaf cert first, then intermediates, then root)