cloudthinker-ai Certificate Renewal Automation Skill
Renew TLS certificate for {{ domain }} ({{ certificate_type }}, expires {{ expiration_date }}).
Workflow
Phase 1 — Certificate Inventory
CERTIFICATE MAP
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Domain: {{ domain }}
[ ] Certificate type: {{ certificate_type }}
[ ] Current expiration: {{ expiration_date }}
[ ] Days until expiration: ___
[ ] SANs (Subject Alternative Names):
- ___
- ___
[ ] Deployed locations:
[ ] Load balancer(s): ___
[ ] CDN distribution(s): ___
[ ] Application server(s): ___
[ ] API gateway(s): ___
[ ] Certificate chain: Root CA -> Intermediate -> Leaf
Phase 2 — Renewal Execution
CERTIFICATE RENEWAL
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
For ACM (AWS Certificate Manager):
[ ] Request renewal via ACM console or CLI
[ ] DNS validation records confirmed
[ ] Certificate status: ISSUED
For Let's Encrypt:
[ ] Certbot renewal executed
[ ] ACME challenge completed
[ ] New certificate files generated
For Manual CA:
[ ] CSR generated with correct SANs
[ ] CSR submitted to CA
[ ] Certificate received and validated
[ ] Private key securely stored
[ ] New certificate details:
- Serial: ___
- Valid from: ___
- Valid until: ___
- Key algorithm: ___
- Key size: ___
Phase 3 — Certificate Deployment
DEPLOYMENT CHECKLIST
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Certificate chain validated (no missing intermediates)
[ ] Deploy to each endpoint:
[ ] Load balancer — applied and listener updated
[ ] CDN — distribution updated, propagation complete
[ ] Application servers — certificate files replaced, service reloaded
[ ] API gateway — certificate attached to custom domain
[ ] OCSP stapling configured (if applicable)
[ ] HSTS headers verified
Phase 4 — Post-Renewal Validation
VALIDATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] TLS connection test successful (openssl s_client)
[ ] Certificate chain complete and trusted
[ ] No mixed content warnings
[ ] SSL Labs rating: ___ (target: A+)
[ ] All SANs resolving correctly
[ ] HTTP to HTTPS redirect working
[ ] No certificate errors in browser
[ ] Monitoring updated with new expiration date
[ ] Alert threshold set: ___ days before expiration
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
Produce a certificate renewal report with:
- Certificate summary (domain, type, old and new expiration dates)
- Deployment log (each endpoint updated with timestamps)
- Validation results (TLS test, chain verification, SSL Labs score)
- Monitoring status (alerting configured for next renewal)
- Next renewal date and recommended automation improvements