Finds Windows certificates that are expiring or already expired, and the self-signed or test-signing certificates that should not be trusted.
The Certificate Expiry Hygiene skill uses Windows certificate data on Lansweeper inventory, joined for owner and role context. It lists leaf certificates by expiration window, identifies self-signed and test-signed certificates, and shows how issuers and certificate stores are spread across the fleet. It produces a dated renewal worklist and a trust-hygiene exception list for preventing expired-certificate outages.
Why the Certificate Expiry Hygiene Skill Matters Here
IT perspective
“Which certificate is about to take a service down?”
Certificates expiring in 30, 60 or 90 days become a dated renewal worklist.
Domain controllers and web servers carrying an expiring certificate can be checked directly.
Security perspective
“Which machines trust something they should not?”
Self-signed and test-signing certificates are listed per machine.
The internal and untrusted CAs the estate depends on are made visible.
Claude 3.5+, ChatGPT, Gemini (Antigravity), Copilot
Step by step setup guide
Step 1: Download Download the skill package for your platform.
Step 2: Install
Claude: install as a skill in Claude Desktop or Claude Code.
ChatGPT: add the skill to your ChatGPT (Codex) skills folder.
Gemini (Antigravity): load the skill into your Antigravity agent’s skill folder.
Copilot: add it as a skill in GitHub Copilot, or import it into Copilot Studio.
Step 3: Connect Lansweeper The skill needs your Lansweeper data to return results. Certificate data comes from Windows scans, so non-Windows assets return none.
Claude: connect the Lansweeper MCP connector and sign in.
ChatGPT: connect Lansweeper MCP, EU or US endpoint based on your tenant.
Gemini (Antigravity): connect a Lansweeper MCP connector separately; Gemini doesn’t ship one built in.
Copilot: connect the Lansweeper MCP connector to your agent.
Step 4: Ask
Claude: “Which certificates are expiring in the next 30, 60 and 90 days?” or “Which machines have test-signing root certificates?”
ChatGPT: trigger with $certificate-expiry-hygiene or “Which machines have test-signing root certificates?”
Gemini (Antigravity): “Do we have self-signed certificates in the environment, and where?”
Copilot: “Are any of our domain controllers or web servers carrying an expiring cert?”
