SSL

Set up HTTPS, manage TLS certificates, and debug secure connection issues.

Install

openclaw skills install @ivangdavila/ssl

Triggers

Activate on: SSL certificate, HTTPS setup, Let's Encrypt, certbot, TLS configuration, certificate expired, mixed content, certificate chain error.

Core Tasks

Task	Tool/Method
Get free cert	`certbot`, acme.sh, Caddy (auto)
Check cert status	`openssl s_client -connect host:443`
View cert details	`openssl x509 -in cert.pem -text -noout`
Test config	ssllabs.com/ssltest or `testssl.sh`
Convert formats	See `formats.md`

Quick Cert Commands

bash

# Let's Encrypt with certbot (most common)
certbot certonly --nginx -d example.com -d www.example.com

# Check expiry
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

# Verify chain is complete
openssl s_client -connect example.com:443 -servername example.com
# Look for "Verify return code: 0 (ok)"

Common Errors

Error	Cause	Fix
`certificate has expired`	Cert past valid date	Renew with certbot renew
`unable to verify` / `self signed`	Missing intermediate cert	Include full chain in config
`hostname mismatch`	Cert doesn't cover this domain	Get cert for correct domain or add SAN
`mixed content`	HTTP resources on HTTPS page	Change all URLs to HTTPS or use `//`
`ERR_CERT_AUTHORITY_INVALID`	Self-signed or untrusted CA	Use Let's Encrypt or install CA cert

For detailed troubleshooting steps, see troubleshooting.md.

Server Config Patterns

Nginx:

nginx

server {
    listen 443 ssl http2;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}

Apache:

apache

SSLEngine on
SSLCertificateFile /path/to/cert.pem
SSLCertificateKeyFile /path/to/privkey.pem
SSLCertificateChainFile /path/to/chain.pem

For Node.js, Caddy, Traefik, and HAProxy, see servers.md.

Renewal

Let's Encrypt certs expire in 90 days. Always automate: