mtls-configuration by wshobson

mTLS Configuration

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

When to Use This Skill

Implementing zero-trust networking
Securing service-to-service communication
Certificate rotation and management
Debugging TLS handshake issues
Compliance requirements (PCI-DSS, HIPAA)
Multi-cluster secure communication

Core Concepts

1. mTLS Flow

┌─────────┐                              ┌─────────┐
│ Service │                              │ Service │
│    A    │                              │    B    │
└────┬────┘                              └────┬────┘
     │                                        │
┌────┴────┐      TLS Handshake          ┌────┴────┐
│  Proxy  │◄───────────────────────────►│  Proxy  │
│(Sidecar)│  1. ClientHello             │(Sidecar)│
│         │  2. ServerHello + Cert      │         │
│         │  3. Client Cert             │         │
│         │  4. Verify Both Certs       │         │
│         │  5. Encrypted Channel       │         │
└─────────┘                              └─────────┘

2. Certificate Hierarchy

Root CA (Self-signed, long-lived)
    │
    ├── Intermediate CA (Cluster-level)
    │       │
    │       ├── Workload Cert (Service A)
    │       └── Workload Cert (Service B)
    │
    └── Intermediate CA (Multi-cluster)
            │
            └── Cross-cluster certs

Templates and detailed worked examples

Full template library and detailed worked examples live in references/details.md. Read that file when you need the concrete templates.

Best Practices

Do's

Start with PERMISSIVE - Migrate gradually to STRICT
Monitor certificate expiry - Set up alerts
Use short-lived certs - 24h or less for workloads
Rotate CA periodically - Plan for CA rotation
Log TLS errors - For debugging and audit

Don'ts

Don't disable mTLS - For convenience in production
Don't ignore cert expiry - Automate rotation
Don't use self-signed certs - Use proper CA hierarchy
Don't skip verification - Verify the full chain

Third-party checks

No alerts16d5 checks · Risk SAFE

Gen Agent Trust Hub16d
This skill provides configuration templates and documentation for implementing mutual TLS (mTLS) in zero-trust service mesh environments. It contains no executable scripts or dangerous code.
Socket16d
No alerts
Snyk16d
Risk: LOW · No issues
Runlayer6mo
1 file scanned · No issues
ZeroLeaks5mo
2 findings · Score: 80/100

Frequently asked

Does this skill cover certificate rotation and expiry management?

Yes. It includes monitoring certificate expiry, setting up alerts, and automating rotation with short-lived certs (24h or less for workloads) and periodic CA rotation.

What service mesh platforms does this skill target?

The skill provides general mTLS concepts and best practices applicable across service mesh implementations, with references to sidecar proxy patterns and workload certificates, but does not specify a particular platform like Istio or Linkerd.

Does this include multi-cluster mTLS setup?

Yes. The certificate hierarchy covers multi-cluster intermediate CAs and cross-cluster certificate configuration for securing communication across clusters.

What's the recommended approach for enabling mTLS in existing systems?

The skill recommends starting with PERMISSIVE mode and migrating gradually to STRICT, rather than enabling strict mTLS immediately in production.

Generated from the current SKILL.md. These answers refresh after source changes.

/mtls-configuration

SKILL.md