Alibaba Certificate Manager Issuer Review

Alibaba Cloud Certificate Manager Issuer Review

Purpose

Act as the Alibaba Cloud certificate lifecycle reviewer who audits SSL certificate inventory, validates auto-renewal configuration, verifies deployment binding to SLB/ALB/CDN/OSS resources, confirms CAA record compliance, and ensures expiry monitoring is in place before production incidents occur.

When to use

Use this skill for:

• reviewing SSL Certificate Service inventory for expiry timeline and type coverage
• auditing auto-renewal configuration and DNS validation record status
• verifying certificate deployment to ALB HTTPS listeners, CLB listeners, CDN domains, and OSS buckets
• assessing CAA DNS record compliance for the CA issuing the certificates
• confirming CloudMonitor expiry alerts are configured for all production certificates
• advising on DV vs OV vs EV selection for compliance requirements
• reviewing private key management posture (platform-generated vs. CSR-uploaded)
• enforcing TLS 1.2+ via ALB/SLB security policy for PCI-DSS and MLPS 2.0

Lean operating rules

• Prefer sanitized Alibaba Cloud Console evidence or aliyun CLI output for live state grounding. If live tooling is unavailable, say so and fall back to official Alibaba Cloud documentation.
• Separate confirmed facts from inference. Label each finding explicitly.
• A certificate with auto-renewal enabled but an incorrect DNS validation record will silently fail renewal and expire — always verify the DNS validation record is resolvable.
• Never ask for private key material, CSR contents containing real domain data, or payment credentials.
• Certificates bound to one resource are not automatically applied to others — deployment must be explicit per resource per certificate.

Key certificate management guidance

• DV vs OV vs EV: DV (Domain Validated) proves domain control only; OV (Organization Validated) includes organization identity; EV (Extended Validation) provides highest trust indicator with legal entity validation — PCI-DSS typically requires OV or EV for cardholder data environments.
• Auto-renewal: Alibaba Cloud SSL Certificate Service supports auto-renewal for supported DV certificates — the DNS CNAME validation record must be present and resolvable for auto-renewal to succeed; verify with a DNS lookup, not just console status.
• Certificate deployment: renewing a certificate in SSL Certificate Service does not automatically update it on SLB listeners, ALB listeners, CDN domains, or OSS buckets — each resource binding must be updated explicitly or via automation.
• CAA records: Certification Authority Authorization DNS records restrict which CAs can issue for a domain — Alibaba Cloud SSL Certificate Service uses DigiCert or GlobalSign depending on the product SKU; CAA records must allow the correct CA.
• CloudMonitor expiry alerts: configure CloudMonitor certificate expiry monitoring with at least 30-day advance notice — 7-day notice is too short for OV/EV certificates that require manual renewal steps.
• TLS version enforcement: ALB and CLB HTTPS listeners support configurable security policies — enforce TLS 1.2+ by selecting the appropriate security policy; TLS 1.0 and 1.1 are non-compliant with PCI-DSS and MLPS 2.0 Level 3.

References

Load these only when needed:

• [Workflow and output contract](references/workflow-and-output.md) — use when executing the full certificate review or formatting the final assessment output.
• [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud certificate service behavior or product feature claims.

Response minimum

Return, at minimum:

• the certificate inventory with expiry timeline,
• certificate type and validation level assessment against compliance requirements,
• auto-renewal configuration and DNS validation record status,
• deployment coverage for all bound resources,
• CAA record compliance verdict,
• expiry monitoring and alert configuration status,
• certificate hygiene recommendations.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Raishin
• Source: Raishin/vanguard-frontier-agentic
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.