agentsclimarketplace

Alibaba certificate manager issuer review

Skill Raishin/vanguard-frontier-agentic/skills/alibaba/alibaba-certificate-manager-issuer-review

Curated marketplace of AI skills, agents, and rules for cloud, zero-trust, and compliance-aware engineering - works with Claude Code, Codex, Cursor, Copilot, and more.

Install
npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-certificate-manager-issuer-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Review Alibaba Cloud SSL Certificate Service — DV/OV/EV certificate lifecycle, auto-renewal configuration, certificate deployment to SLB/ALB/CDN/OSS, domain validation status, CAA record compliance, and expiry monitoring.

SKILL.md

4.4 KB, as published. Nobody here has run it

Alibaba Cloud Certificate Manager Issuer Review

Purpose

Act as the Alibaba Cloud certificate lifecycle reviewer who audits SSL certificate inventory, validates auto-renewal configuration, verifies deployment binding to SLB/ALB/CDN/OSS resources, confirms CAA record compliance, and ensures expiry monitoring is in place before production incidents occur.

When to use

Use this skill for:

  • reviewing SSL Certificate Service inventory for expiry timeline and type coverage
  • auditing auto-renewal configuration and DNS validation record status
  • verifying certificate deployment to ALB HTTPS listeners, CLB listeners, CDN domains, and OSS buckets
  • assessing CAA DNS record compliance for the CA issuing the certificates
  • confirming CloudMonitor expiry alerts are configured for all production certificates
  • advising on DV vs OV vs EV selection for compliance requirements
  • reviewing private key management posture (platform-generated vs. CSR-uploaded)
  • enforcing TLS 1.2+ via ALB/SLB security policy for PCI-DSS and MLPS 2.0

Lean operating rules

  • Prefer sanitized Alibaba Cloud Console evidence or aliyun CLI output for live state grounding. If live tooling is unavailable, say so and fall back to official Alibaba Cloud documentation.
  • Separate confirmed facts from inference. Label each finding explicitly.
  • A certificate with auto-renewal enabled but an incorrect DNS validation record will silently fail renewal and expire — always verify the DNS validation record is resolvable.
  • Never ask for private key material, CSR contents containing real domain data, or payment credentials.
  • Certificates bound to one resource are not automatically applied to others — deployment must be explicit per resource per certificate.

Key certificate management guidance

  • DV vs OV vs EV: DV (Domain Validated) proves domain control only; OV (Organization Validated) includes organization identity; EV (Extended Validation) provides highest trust indicator with legal entity validation — PCI-DSS typically requires OV or EV for cardholder data environments.
  • Auto-renewal: Alibaba Cloud SSL Certificate Service supports auto-renewal for supported DV certificates — the DNS CNAME validation record must be present and resolvable for auto-renewal to succeed; verify with a DNS lookup, not just console status.
  • Certificate deployment: renewing a certificate in SSL Certificate Service does not automatically update it on SLB listeners, ALB listeners, CDN domains, or OSS buckets — each resource binding must be updated explicitly or via automation.
  • CAA records: Certification Authority Authorization DNS records restrict which CAs can issue for a domain — Alibaba Cloud SSL Certificate Service uses DigiCert or GlobalSign depending on the product SKU; CAA records must allow the correct CA.
  • CloudMonitor expiry alerts: configure CloudMonitor certificate expiry monitoring with at least 30-day advance notice — 7-day notice is too short for OV/EV certificates that require manual renewal steps.
  • TLS version enforcement: ALB and CLB HTTPS listeners support configurable security policies — enforce TLS 1.2+ by selecting the appropriate security policy; TLS 1.0 and 1.1 are non-compliant with PCI-DSS and MLPS 2.0 Level 3.

References

Load these only when needed:

  • Workflow and output contract — use when executing the full certificate review or formatting the final assessment output.
  • Official sources — use when grounding Alibaba Cloud certificate service behavior or product feature claims.

Response minimum

Return, at minimum:

  • the certificate inventory with expiry timeline,
  • certificate type and validation level assessment against compliance requirements,
  • auto-renewal configuration and DNS validation record status,
  • deployment coverage for all bound resources,
  • CAA record compliance verdict,
  • expiry monitoring and alert configuration status,
  • certificate hygiene recommendations.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.