证书生命周期管理工具（cert lifecycle harness）
v1.0.0A harness for 图形界面ding humans through the full lifecycle of an X.509/TLS certificate renewal, replacement, or 迁移 in complex infrastructures (CDN / LB / K8s / self-hosted gateway / mTLS). The 技能 turns "生成 a renewal script" into a rigorous 助手 工作流: (1) split review into L3 / L2 / L1 layers so every reviewer has a bounded time bud获取; (2) treat the 代理 as "safety officer + document engineer + trusted executor", not an autonomous SRE; (3) enforce a six-gate protocol before any write API is 执行d on behalf of the user, and never 执行 删除; (4) classify as设置 discovery as a graph closure (domAIn ↔ certificate), with wildcard fan-out, cross-zone authorization boundaries, and shadow certificate provenance; (5) adapt to the upcoming CA/B Forum validity shrinkage timeline (398 → 200 → 100 → 47 days). Use this 技能 whenever the user's question is about renewing, migrating, 审计ing, or hardening TLS certificates across real production 系统s — especially when the risks "expire = outage" and "one wrong field = P0" 应用ly. Not intended for one-off `openssl req` examples or pure PKI theory.
by 运行时依赖
安装命令
点击复制技能文档
Cert-Lifecycle-Harness 适用场景：证书续签 / CA 迁移 / 证书整改 / 多域证书体系盘点 / 应急换证 不适用：pure PKI 教学、一次性 openssl req 样例、本地自签证书 两个刚性约束：① 过期即故障（不是"改砸了回滚"，而是"没来得及改就爆炸"）② 高危操作（错一个字段就是 P0）
- 核心定位（必读）
- 生成指引、脚本、清单、对比报告（文本产物）
- 做分层 code-review 预审，减轻人类负担
- 主动识别信息缺口，引导人类补齐
- 在用户授权范围内代为执行【只读 API】，减轻用户手动盘点负担
- 在满足【六条闸门】前提下代为执行【写 API（Import / Modify 类）】
- 未经用户明确授权不调用任何 cloud API / kubectl
- 任何情况下不代为执行 Delete 类写操作（删证书、删绑定、删资源等），一律只生成脚本
- 任何闸门未满足时不代为执行 Import / Modify 类写操作
- 不 ssh 进生产、不改生产配置文件
- 不用自己的知识脑补客户特定信息（CDN 厂商、域名清单、审批人等）
- 不代替人类做最终审批（review 通过必须由人类明示）
- 证书有效期时代背景
- 复杂度分流（Fast / Standard / Full Path）