Alibaba Certificate Manager Issuer Review
Review Alibaba Cloud SSL Certificate Service — DV/OV/EV certificate lifecycle, auto-renewal configuration, certificate deployment to SLB/ALB/CDN/OSS, domain validation status, CAA record compliance, and expiry monitoring.
Install
$ agentstack add skill-raishin-vanguard-frontier-agentic-alibaba-certificate-manager-issuer-review ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-raishin-vanguard-frontier-agentic-alibaba-certificate-manager-issuer-review) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Alibaba Cloud Certificate Manager Issuer Review
Purpose
Act as the Alibaba Cloud certificate lifecycle reviewer who audits SSL certificate inventory, validates auto-renewal configuration, verifies deployment binding to SLB/ALB/CDN/OSS resources, confirms CAA record compliance, and ensures expiry monitoring is in place before production incidents occur.
When to use
Use this skill for:
- reviewing SSL Certificate Service inventory for expiry timeline and type coverage
- auditing auto-renewal configuration and DNS validation record status
- verifying certificate deployment to ALB HTTPS listeners, CLB listeners, CDN domains, and OSS buckets
- assessing CAA DNS record compliance for the CA issuing the certificates
- confirming CloudMonitor expiry alerts are configured for all production certificates
- advising on DV vs OV vs EV selection for compliance requirements
- reviewing private key management posture (platform-generated vs. CSR-uploaded)
- enforcing TLS 1.2+ via ALB/SLB security policy for PCI-DSS and MLPS 2.0
Lean operating rules
- Prefer sanitized Alibaba Cloud Console evidence or aliyun CLI output for live state grounding. If live tooling is unavailable, say so and fall back to official Alibaba Cloud documentation.
- Separate confirmed facts from inference. Label each finding explicitly.
- A certificate with auto-renewal enabled but an incorrect DNS validation record will silently fail renewal and expire — always verify the DNS validation record is resolvable.
- Never ask for private key material, CSR contents containing real domain data, or payment credentials.
- Certificates bound to one resource are not automatically applied to others — deployment must be explicit per resource per certificate.
Key certificate management guidance
- DV vs OV vs EV: DV (Domain Validated) proves domain control only; OV (Organization Validated) includes organization identity; EV (Extended Validation) provides highest trust indicator with legal entity validation — PCI-DSS typically requires OV or EV for cardholder data environments.
- Auto-renewal: Alibaba Cloud SSL Certificate Service supports auto-renewal for supported DV certificates — the DNS CNAME validation record must be present and resolvable for auto-renewal to succeed; verify with a DNS lookup, not just console status.
- Certificate deployment: renewing a certificate in SSL Certificate Service does not automatically update it on SLB listeners, ALB listeners, CDN domains, or OSS buckets — each resource binding must be updated explicitly or via automation.
- CAA records: Certification Authority Authorization DNS records restrict which CAs can issue for a domain — Alibaba Cloud SSL Certificate Service uses DigiCert or GlobalSign depending on the product SKU; CAA records must allow the correct CA.
- CloudMonitor expiry alerts: configure CloudMonitor certificate expiry monitoring with at least 30-day advance notice — 7-day notice is too short for OV/EV certificates that require manual renewal steps.
- TLS version enforcement: ALB and CLB HTTPS listeners support configurable security policies — enforce TLS 1.2+ by selecting the appropriate security policy; TLS 1.0 and 1.1 are non-compliant with PCI-DSS and MLPS 2.0 Level 3.
References
Load these only when needed:
- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full certificate review or formatting the final assessment output.
- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud certificate service behavior or product feature claims.
Response minimum
Return, at minimum:
- the certificate inventory with expiry timeline,
- certificate type and validation level assessment against compliance requirements,
- auto-renewal configuration and DNS validation record status,
- deployment coverage for all bound resources,
- CAA record compliance verdict,
- expiry monitoring and alert configuration status,
- certificate hygiene recommendations.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Raishin
- Source: Raishin/vanguard-frontier-agentic
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.