Skip to content
Get packs

Configuring a Certificate Authority with OpenSSL

Builds a two-tier PKI certificate authority (root plus intermediate) for issuing and revoking certificates.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill teaches an AI agent to set up a small private certificate authority, the kind of trust anchor that signs the digital certificates used for HTTPS, code signing, and client logins inside an organization. It walks through creating an offline root CA, an intermediate CA that signs day-to-day certificates, server and client certificates, revocation lists, and OCSP settings. The bundled Python scripts can generate these keys and certificates programmatically with the cryptography library.

Great for

  • Engineers building or testing an internal PKI in a lab or staging environment
  • Students learning how X.509 certificate chains, extensions, and revocation work
  • Security teams reviewing or documenting how a CA hierarchy should be structured

Skip it if

  • Producing production trust roots without review: the scripts write private keys to disk and the guidance on offline, HSM-protected root keys is only described, not enforced, so a production CA needs proper key ceremony and tooling
  • Anyone who needs to issue certificates for public websites: a private CA is not trusted by browsers, and public certificates must come from a publicly trusted CA

Try asking

  • “Set up a two-tier internal CA with a root and an intermediate for our lab network”
  • “Issue a server certificate for server.example.com from our intermediate CA”
  • “Revoke certificate serial 1001 and regenerate the CRL”
  • “Walk me through which X.509 extensions a code-signing intermediate CA needs”
Step-by-step guide: how to use Configuring a Certificate Authority with OpenSSLInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    configuring-certificate-authority-with-openssl.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip configuring-certificate-authority-with-openssl.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip configuring-certificate-authority-with-openssl.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run everything in an isolated lab or test environment and keep generated private keys out of shared repositories
  • Read the generated scripts before running them, since they create and save private keys and may write to the directory you specify with --output
  • Treat the root CA as offline: move its key off the machine after the intermediate is signed, and review the validation checklist before trusting the output

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.