# Certificate Renewal Automation

> Use when performing certificate renewal automation — runbook for TLS/SSL certificate renewal across infrastructure. Covers certificate inventory, expiration tracking, CSR generation, certificate issuance, deployment to load balancers and CDNs, chain validation, and post-renewal verification to prevent outages from expired certificates.

- Skill: `cloudthinker-ai/certificate-renewal-automation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cloudthinker-ai/certificate-renewal-automation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cloudthinker-ai/certificate-renewal-automation/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cloudthinker-ai (https://skillmd.com/u/cloudthinker-ai)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/cloudthinker-ai/certificate-renewal-automation

---


# Certificate Renewal Automation Skill

Renew TLS certificate for **{{ domain }}** ({{ certificate_type }}, expires **{{ expiration_date }}**).

## Workflow

### Phase 1 — Certificate Inventory

```
CERTIFICATE MAP
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Domain: {{ domain }}
[ ] Certificate type: {{ certificate_type }}
[ ] Current expiration: {{ expiration_date }}
[ ] Days until expiration: ___
[ ] SANs (Subject Alternative Names):
    - ___
    - ___
[ ] Deployed locations:
    [ ] Load balancer(s): ___
    [ ] CDN distribution(s): ___
    [ ] Application server(s): ___
    [ ] API gateway(s): ___
[ ] Certificate chain: Root CA -> Intermediate -> Leaf
```

### Phase 2 — Renewal Execution

```
CERTIFICATE RENEWAL
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
For ACM (AWS Certificate Manager):
[ ] Request renewal via ACM console or CLI
[ ] DNS validation records confirmed
[ ] Certificate status: ISSUED

For Let's Encrypt:
[ ] Certbot renewal executed
[ ] ACME challenge completed
[ ] New certificate files generated

For Manual CA:
[ ] CSR generated with correct SANs
[ ] CSR submitted to CA
[ ] Certificate received and validated
[ ] Private key securely stored

[ ] New certificate details:
    - Serial: ___
    - Valid from: ___
    - Valid until: ___
    - Key algorithm: ___
    - Key size: ___
```

### Phase 3 — Certificate Deployment

```
DEPLOYMENT CHECKLIST
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Certificate chain validated (no missing intermediates)
[ ] Deploy to each endpoint:
    [ ] Load balancer — applied and listener updated
    [ ] CDN — distribution updated, propagation complete
    [ ] Application servers — certificate files replaced, service reloaded
    [ ] API gateway — certificate attached to custom domain
[ ] OCSP stapling configured (if applicable)
[ ] HSTS headers verified
```

### Phase 4 — Post-Renewal Validation

```
VALIDATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] TLS connection test successful (openssl s_client)
[ ] Certificate chain complete and trusted
[ ] No mixed content warnings
[ ] SSL Labs rating: ___ (target: A+)
[ ] All SANs resolving correctly
[ ] HTTP to HTTPS redirect working
[ ] No certificate errors in browser
[ ] Monitoring updated with new expiration date
[ ] Alert threshold set: ___ days before expiration
```

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format

Produce a certificate renewal report with:
1. **Certificate summary** (domain, type, old and new expiration dates)
2. **Deployment log** (each endpoint updated with timestamps)
3. **Validation results** (TLS test, chain verification, SSL Labs score)
4. **Monitoring status** (alerting configured for next renewal)
5. **Next renewal date** and recommended automation improvements