# Ssl Cert Renew

> Check SSL certificate expiry across managed properties; flag anything within 30 days; renew where the renewal is automatable (Let's Encrypt, Cloudflare-managed). Use weekly via cron.

- Skill: `jezweb/ssl-cert-renew` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jezweb/ssl-cert-renew`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jezweb/ssl-cert-renew/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: jezweb (https://skillmd.com/u/jezweb)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jezweb/ssl-cert-renew

---


# SSL cert renew

Don't let a cert expire silently.

## Steps

1. List every property in `wiki/properties/websites/` (or scope from input)
2. For each: query the live cert via openssl or fetch + inspect
3. Compute days-to-expiry
4. Classify:
   - **OK** (>30 days): no action
   - **Warn** (8-30 days): file a finding to surface to boss
   - **Critical** (<7 days): file an URGENT finding + auto-renew if Let's Encrypt + cf-managed
5. Auto-renewable cases: trigger `wrangler ssl ... renew` or equivalent provider API
6. Save per-property cert status to `wiki/properties/websites/<domain>/cert-status.md`

## Output

```yaml
---
kind: ssl-status
domain: <domain>
issuer: <issuer>
not_after: <ISO>
days_to_expiry: <int>
status: ok | warn | critical
auto_renew_supported: bool
last_checked: <date>
---
```

## Anti-patterns

- Renewing a cert without verifying the domain is still valid (e.g. transferred away)
- Renewing a cert and forgetting to update CAA records
- Silent failure modes — every check must produce an entry