Triggers include: "certificate diagnosis", "certificate expiry", "HTTPS certificate", "certificate configuration", "SSL certificate", "cert expiry check". Diagnose CDN HTTPS certificate configuration and expiration status using hcloud CLI. Query the certificate configuration via ShowCertificatesHttpsInfo/v2, probe the actual certificate served by the CDN edge via a Python TLS probe script (scripts/cert_probe.py), and compute days remaining until expiration to identify certificate misconfiguration, impending expiry, or already-expired certificates. Use this skill when the user wants to: (1) diagnose CDN HTTPS certificate issues, (2) check certificate expiration status, (3) verify SSL/TLS certificate configuration on a CDN domain, (4) troubleshoot HTTPS certificate deployment failures. Do NOT use this skill for certificate configuration changes (upload/update/delete/renew), CDN domain management, or non-CDN domains — this is a read-only diagnosis skill.
This skill diagnoses CDN domain HTTPS certificate configuration and expiration status. It queries the certificate configuration on CDN via hcloud CLI (ShowCertificatesHttpsInfo/v2), probes
the actual certificate served by the CDN edge node via a Python TLS probe script (python scripts/cert_probe.py), and computes days remaining until expiration via a Python script, helping
users identify issues such as certificate not configured, configuring, impending expiry, or already expired.
Retrieves the certificate name and expiration time configured on CDN
Probes the actual served certificate chain via scripts/cert_probe.py (expiration time, issuer, CN, SAN; JSON output)
Computes days remaining via Python (normal / warning / expired)
Structured diagnosis report with a mandatory Certificate Summary block that explicitly prints the certificate's common info (name, status, issuer, CN, SAN, validity period, days
remaining) to the user
Fix recommendations
Tool: hcloud CLI (KooCLI) + Python >= 3.8 (stdlib ssl + socket for the probe; no third-party dependency)
Probe Timeout: 10 seconds (enforced by cert_probe.py via --timeout, default 10, range 1-30)
Core Principle: Read-only diagnosis; no configuration changes are performed
Scope
This skill is scoped to CDN HTTPS certificate diagnosis only — one class of problem.
In scope:
Querying CDN domain certificate configuration via ShowCertificatesHttpsInfo/v2 (https_status, cert_name, expiration_time)
Probing the certificate actually served by the CDN edge via scripts/cert_probe.py (issuer, CN, SAN, validity period)
Computing days remaining until expiration via scripts/cert_expiry_check.py
Generating a structured certificate diagnosis report with conclusion and fix recommendations
TLS/HTTPS inspection of non-CDN domains or general websites
Any non-GET CDN operation — see the Prohibited Operations section below
Applicable scenarios: the user asks to diagnose CDN HTTPS certificate issues,
check certificate expiration status, verify SSL/TLS certificate configuration on
a CDN domain, or troubleshoot HTTPS certificate deployment failures.
Triggers
Use this skill when the user's request matches any of the following:
The user wants to configure, update, delete, or renew a certificate — refuse and direct to the Huawei Cloud CDN console or manual hcloud CLI (see the Prohibited Operations section below)
The domain is not a CDN-accelerated domain — cert_probe.py only probes CDN-accelerated domains via a TLS handshake
The user wants CDN domain management (create/delete/enable/disable domains, origin, cache rules, billing)
The user wants general port scanning or network diagnostics — this skill performs a single TLS handshake against <domain>:443 only
The user wants CDN traffic statistics or monitoring
⛔ Prohibited Operations (Security Constraints)
This skill strictly forbids all non-GET (write/modify/delete) CDN operations, regardless of user requests.
Total: 55 prohibited operations (24 POST + 25 PUT + 6 DELETE).
If a user requests a prohibited operation, you must refuse and inform:
"Per security constraints, this skill does not allow write/delete/modify operations. This skill is read-only for certificate diagnosis. Please use the Huawei Cloud CDN console or run
hcloud CLI manually for certificate configuration changes. The complete list of 55 prohibited operations is documented in references/prohibited-operations.md."
Architecture
text
CDN Certificate Diagnosis
├── hcloud configure list (credential validation)
├── ShowDomainDetailByName (domain permission validation + basic info)
├── ShowCertificatesHttpsInfo/v2 (certificate configuration query)
│ ├── Match https[] element by domain_name (response is wrapped in total/https)
│ ├── https_status=0 → certificate not configured; stop and report
│ ├── https_status=2 → certificate configuring; prompt to wait
│ └── https_status=3 → certificate configured; continue probing
├── python scripts/cert_probe.py (actual certificate status probe)
│ ├── Parse JSON: data.tls.subject_cn, data.tls.issuer_cn, data.tls.not_before, data.tls.not_after, data.tls.san_list (wrapped in {result, data, error_msg})
│ └── Compare data.tls.not_after against API-returned expiration_time
├── python scripts/cert_expiry_check.py (days remaining calculation)
│ ├── data.days_remaining > 30 → normal
│ ├── 0 < data.days_remaining ≤ 30 → warning
│ └── data.days_remaining ≤ 0 → expired
└── Generate diagnosis report
Prerequisite check: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required
Run hcloud version to verify the version. If not installed or version is too low,
see references/cli-installation-guide.md.
bash
hcloud version
Prerequisite check: Python >= 3.8 available
Python is required to run the certificate probe script scripts/cert_probe.py
and the days-remaining calculation script scripts/cert_expiry_check.py.
The probe uses only the Python standard library (ssl, socket),
so no third-party packages need to be installed.
bash
python --version
Prerequisite check: hcloud credentials configured
Before performing CDN operations, you must verify hcloud credentials are configured:
bash
hcloud configure list
If no valid credentials exist, stop and guide the user to configure credentials.
⚠️ hcloud parameter format requirements
hcloud (KooCLI) all parameters must use the --param=value format (connected with equals sign); space-separated format is not supported.
CDN APIs only support two regions: cn-north-1 (Beijing) and ap-southeast-1 (Singapore).
Query results are region-independent (CDN is a global service).
Recommended: use cn-north-1.
Authentication
Prerequisite check: Huawei Cloud credentials
Security rules (must be followed):
Prohibited from reading, echoing, or printing AK/SK values
Prohibited from asking the user to input AK/SK directly in the conversation
Prohibited from using hcloud configure set to pass plaintext credential values
Prohibited from accepting AK/SK directly provided by the user in the conversation
Only allowed to read credentials from environment variables or configured CLI config files
⚠️ Important: Handling user-provided credentials
If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
Stop immediately - Do not execute any commands
Politely refuse and return the following message:
text
For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation.
Please use one of the following secure methods to configure credentials:
Method 1: Interactive configuration (recommended)
hcloud configure
# Enter AK/SK as prompted; credentials will be securely stored in a local config file
Method 2: Environment variable configuration
export HUAWEICLOUD_SDK_AK=<your-access-key-id>
export HUAWEICLOUD_SDK_SK=<your-secret-key>
After configuration is complete, please retry your request.
Do not continue executing any Huawei Cloud operations until credentials are configured
Check CLI configuration:
bash
hcloud configure list
Check whether the output contains valid configuration (AK/SK, IAM, etc.).
All hcloud commands should use --cli-region=<region>
cert_probe.py enforces a 10-second timeout by default (configurable via --timeout, range 1-30) and emits a single JSON object on stdout with the TLS certificate metadata
The Python probe uses stdlib ssl + socket only; no third-party dependency needs to be installed
The Python script handles only the days-remaining calculation logic; it does not handle business flow. Its output is wrapped in the platform standard {result, data, error_msg} envelope —
read data.days_remaining / data.status
When expiration_time is empty, the Python script outputs {"result": "success", "data": {"days_remaining": null, "status": "unknown"}, "error_msg": ""}
Parameter Confirmation
Before executing the diagnosis, confirm the following parameters with the user:
Parameter
Required
Description
Default
Example
domain_name
Yes
CDN accelerated domain to diagnose
None
www.example.com
--cli-region
Yes
Huawei Cloud region
cn-north-1
cn-north-1
User Confirmation Checklist:
Target domain provided
User understands this is a read-only diagnosis operation
User understands the probe command has a 10-second timeout
User understands this skill does not perform certificate configuration changes
Core Workflows
Target domain is required before any diagnosis step.
If the user did not provide a target domain, ask the user for the domain name and wait for the reply before starting.
Only if the user does not know the domain or asks you to look it up, list the account's domains via hcloud CDN ListDomains/v2 and ask the user to choose one.
Never start the diagnosis without an explicit user-provided domain: do not guess a domain, do not fall back to an example/default domain, and do not pick a domain from the list yourself.
Step 1: Credential Validation and Domain Permission Validation
Check hcloud credential availability, and validate via ShowDomainDetailByName that the domain belongs to the current account.
Probe the certificate chain information (expiration time, issuer, CN, SAN) actually served by the CDN edge node via python scripts/cert_probe.py --domain <domain_name> --timeout 10. The
script emits a single JSON object on stdout wrapped in the {result, data, error_msg} envelope, with business fields inside data: data.domain, data.connected, data.tls
(subject_cn, issuer_cn, not_before, not_after, san_list), data.duration_ms, and data.error ({reason, message} on failure).
Aggregate the query and probe results to generate a structured text diagnosis report. The report MUST include a mandatory Certificate Summary (Common Info) block that explicitly prints
the certificate's commonly used information (certificate name, status, issuer, CN, SAN, Valid From / Expires On, days remaining) directly to the user.
Symptom: hcloud configure list shows no AK/SK; hcloud commands return an authentication error.
Fix: Run hcloud configure interactively, or export HUAWEICLOUD_SDK_AK / HUAWEICLOUD_SDK_SK, then re-verify with hcloud configure list.
Q2: Domain not found (404 / CDN.0171)
Symptom: ShowDomainDetailByName returns 404 or error_code: CDN.0171.
Fix: Check the domain spelling; confirm the domain is onboarded to CDN under the current account; run hcloud CDN ListDomains/v2 --cli-region=<region> --page_size=100 to list onboarded domains.
Q3: Insufficient permission (403)
Symptom: ShowDomainDetailByName or ShowCertificatesHttpsInfo/v2 returns 403.
Fix: Ensure the IAM user has cdn:*:query* (plus cdn:configuration:queryDomains); contact the primary account administrator to grant them (see iam-policies.md).
Q4: cert_probe.py times out or cannot connect
Symptom: data.error.reason == "connect_timeout" / "connect_failed".
Fix: Return partial results annotated "Certificate probe timed out"; check TCP 443 egress and confirm the CNAME is in effect; re-run the probe manually.
Q5: https_status=0 (certificate not configured)
Symptom: ShowCertificatesHttpsInfo/v2 returns https_status=0.
Fix: Report "This domain has no HTTPS certificate configured"; skip probe and calculation; recommend configuring a certificate in the CDN console.
Known limitations:
The probe checks only TCP 443 (<domain>:443); non-standard ports and HTTP-only domains are not probed
CDN APIs support only two regions: cn-north-1 and ap-southeast-1 (recommended: cn-north-1)
Probe results and the API may differ temporarily due to cache or sync latency
Common error codes:
Error
Meaning
Handling
404 / CDN.0171
Domain not found or not under the current account
Stop; confirm domain ownership
403
Insufficient permission
Stop; grant cdn:*:query* + cdn:configuration:queryDomains
Report the real deployment state; cross-check API expiration_time; never relax verification
expiration_time empty
API returns no valid expiration_time
Do not calculate; report "Expiration time unknown"; expose the raw API response
Python unavailable
python --version fails or < 3.8
Install Python >= 3.8, or calculate days remaining manually from the ms timestamp
Self-check before report output: verify the mandatory Certificate Summary block (name / status / issuer / CN / SAN / Valid From / Expires On / Days Remaining) is complete, and N/A is
used only for genuinely unavailable fields; never present a probe failure as a success.
Failure propagation: each failure is surfaced as data.error.reason in the {result, data, error_msg} envelope and reflected in the report's Diagnosis Items with ✅/❌/⚠️ markers; no
failure is silently dropped.
Output Format
All machine-readable outputs use the platform standard envelope:
Status markers: ✅ Pass (normal) / ❌ Fail (failed or expired) / ⚠️ Warning (about to expire, configuring, timed out, partial) / N/A (step not involved). Full decision table and example reports: references/task-report-generation.md.
Prohibited in output (never include): AK/SK or any credential material; raw DER/PEM certificate bytes or private keys; raw millisecond timestamps as the primary display (convert to
readable dates); internal URLs or tokens.
Migrated the TLS probe from the legacy HTTP-based implementation to scripts/cert_probe.py (stdlib ssl/socket, zero third-party dependency); added scripts/cert_expiry_check.py; introduced the {result, data, error_msg} JSON contract; IAM scope unchanged
Deprecation notice: the legacy HTTP-based probe (v1.0.0) is deprecated and must not be used; all diagnosis must run through the Python probe scripts.
