implementing-tls

Name: implementing-tls
Author: ancoleman

55installs59forks

How to install implementing-tls?

ancoleman/ai-design-components/implementing-tls

$npx -y skills add ancoleman/ai-design-components --skill implementing-tls

Installs into the current project.

Summary

Configure TLS certificates and encryption for secure communications. Use when setting up HTTPS, securing service-to-service connections, implementing mutual TLS (mTLS), or debugging certificate issues.

Files · 1

View on GitHub

SKILL.md

1	# Implementing TLS
2
3	## Purpose
4
5	Implement Transport Layer Security (TLS) for encrypting network communications and authenticating services. Generate certificates, automate certificate lifecycle management with Let's Encrypt or internal CAs, configure TLS 1.3, implement mutual TLS for service authentication, and debug common certificate issues.
6
7	## When to Use This Skill
8
9	Trigger this skill when:
10	- Setting up HTTPS for web applications or APIs
11	- Securing service-to-service communication in microservices
12	- Implementing mutual TLS (mTLS) for zero-trust networks
13	- Generating certificates for development or production
14	- Automating certificate renewal and rotation
15	- Debugging certificate validation errors
16	- Configuring TLS termination at load balancers
17	- Setting up internal PKI for corporate networks
18
19	## Quick Start
20
21	### For Development (Local HTTPS)
22
23	Use mkcert for trusted local certificates:
24
25	```bash
26	# Install mkcert
27	brew install mkcert # macOS
28	# sudo apt install mkcert # Linux
29
30	# Install local CA
31	mkcert -install
32
33	# Generate certificate
34	mkcert example.com localhost 127.0.0.1
35	# Creates: example.com+2.pem and example.com+2-key.pem
36	```
37
38	### For Production (Public HTTPS)
39
40	Kubernetes with cert-manager:
41	```bash
42	# Install cert-manager
43	helm install cert-manager jetstack/cert-manager \
44	--namespace cert-manager --create-namespace \
45	--set installCRDs=true
46
47	# Create Let's Encrypt issuer
48	kubectl apply -f - <<EOF
49	apiVersion: cert-manager.io/v1
50	kind: ClusterIssuer
51	metadata:
52	name: letsencrypt-prod
53	spec:
54	acme:
55	server: https://acme-v02.api.letsencrypt.org/directory
56	email: admin@example.com
57	privateKeySecretRef:
58	name: letsencrypt-prod-key
59	solvers:
60	- http01:
61	ingress:
62	class: nginx
63	EOF
64	```
65
66	Traditional servers with Certbot:
67	```bash
68	# Install certbot
69	sudo apt install certbot
70
71	# Obtain certificate
72	sudo certbot certonly --standalone -d example.com -d www.example.com
73	# Certificates saved to /etc/letsencrypt/live/example.com/
74	```
75
76	### For Internal Services (Internal PKI)
77
78	Generate internal CA with CFSSL:
79
80	```bash
81	# Install CFSSL
82	brew install cfssl # macOS
83
84	# Create CA
85	cfssl genkey -initca ca-csr.json \| cfssljson -bare ca
86
87	# Generate server certificate
88	cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
89	-config=ca-config.json -profile=server \
90	server-csr.json \| cfssljson -bare server
91	```
92
93	See `examples/cfssl-ca/` for complete configuration files.
94
95	## TLS 1.3 Configuration Best Practices
96
97	### Protocol Versions
98
99	Enable TLS 1.3 and 1.2 only:
100	```nginx
101	# Nginx
102	ssl_protocols TLSv1.3 TLSv1.2;
103	ssl_prefer_server_ciphers off; # Let client choose
104	```
105
106	Disable obsolete protocols: SSLv3, TLS 1.0, TLS 1.1.
107
108	### Cipher Suites
109
110	TLS 1.3 (5 cipher suites):
111	```
112	TLS_AES_256_GCM_SHA384 # Recommended
113	TLS_CHACHA20_POLY1305_SHA256 # Mobile-optimized
114	TLS_AES_128_GCM_SHA256 # Performance
115	```
116
117	TLS 1.2 fallback:
118	```nginx
119	ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305';
120	```
121
122	### Security Features
123
124	- Perfect Forward Secrecy (PFS): Use ephemeral key exchanges (ECDHE)
125	- OCSP Stapling: Enable for performance and privacy
126	- HSTS: Force HTTPS with `Strict-Transport-Security` header
127	- Disable compression: Prevent CRIME attacks
128
129	For detailed TLS 1.3 configuration, see `references/tls13-best-practices.md`.
130
131	## Decision Framework
132
133	### Certificate Type Selection
134
135	```
136	Need TLS certificate?
137	│
138	├─ Public-facing (internet users)?
139	│ │
140	│ ├─ Single domain → Let's Encrypt with HTTP-01
141	│ │ Tools: certbot, cert-manager
142	│ │ Challenge: HTTP verification
143	│ │
144	│ └─ Multiple subdomains → Let's Encrypt with DNS-01
145	│ Tools: certbot with DNS plugin, cert-manager
146	│ Challenge: DNS TXT records
147	│ Supports: Wildcard certificates (*.example.com)
148	│
149	└─ Internal (corporate network)?
150	│
151	├─ Development → mkcert or self-signed
152	│ Tools: mkcert (trusted), openssl (basic)
153	│ No automation needed
154	│
155	└─ Production → Internal CA
156	│
157	├─ Small scale (<10 services) → CFSSL
158	│ Manual management acceptable
159	│
160	└─ Large scale (100+ services) → Vault PKI or cert-manager
161	Dynamic secrets, automatic rotation
162	```
163
164	### Automation Tool Selection
165
166	```
167	Environment?
168	│
169	├─ Kubernetes → cert-manager
170	│ Native CRDs, Ingress integration
171	│ Supports: Let's Encrypt, Vault, CA, self-signed
172	│
173	├─ Traditional servers (VMs) → Certbot (public) or CFSSL (internal)
174	│ Plugins: nginx, apache, DNS providers
175	│ Automated renewal via cron/systemd
176	│
177	├─ Microservices (any platform) → HashiCorp Vault PKI
178	│ Dynamic secrets, short-lived certs
179	│ API-driven, service mesh integration
180	│
181	└─ Developer workstation → mkcert
182	Trusted by browser automatically
183	```
184
185	### Standard TLS vs Mutual T

People who liked this also viewed

6 picks

Type

implementing-tls

55installs59forks

View on GitHub

How to install implementing-tls?

ancoleman/ai-design-components/implementing-tls

$npx -y skills add ancoleman/ai-design-components --skill implementing-tls

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Implementing TLS
2
3	## Purpose
4
5	Implement Transport Layer Security (TLS) for encrypting network communications and authenticating services. Generate certificates, automate certificate lifecycle management with Let's Encrypt or internal CAs, configure TLS 1.3, implement mutual TLS for service authentication, and debug common certificate issues.
6
7	## When to Use This Skill
8
9	Trigger this skill when:
10	- Setting up HTTPS for web applications or APIs
11	- Securing service-to-service communication in microservices
12	- Implementing mutual TLS (mTLS) for zero-trust networks
13	- Generating certificates for development or production
14	- Automating certificate renewal and rotation
15	- Debugging certificate validation errors
16	- Configuring TLS termination at load balancers
17	- Setting up internal PKI for corporate networks
18
19	## Quick Start
20
21	### For Development (Local HTTPS)
22
23	Use mkcert for trusted local certificates:
24
25	```bash
26	# Install mkcert
27	brew install mkcert # macOS
28	# sudo apt install mkcert # Linux
29
30	# Install local CA
31	mkcert -install
32
33	# Generate certificate
34	mkcert example.com localhost 127.0.0.1
35	# Creates: example.com+2.pem and example.com+2-key.pem
36	```
37
38	### For Production (Public HTTPS)
39
40	Kubernetes with cert-manager:
41	```bash
42	# Install cert-manager
43	helm install cert-manager jetstack/cert-manager \
44	--namespace cert-manager --create-namespace \
45	--set installCRDs=true
46
47	# Create Let's Encrypt issuer
48	kubectl apply -f - <<EOF
49	apiVersion: cert-manager.io/v1
50	kind: ClusterIssuer
51	metadata:
52	name: letsencrypt-prod
53	spec:
54	acme:
55	server: https://acme-v02.api.letsencrypt.org/directory
56	email: admin@example.com
57	privateKeySecretRef:
58	name: letsencrypt-prod-key
59	solvers:
60	- http01:
61	ingress:
62	class: nginx
63	EOF
64	```
65
66	Traditional servers with Certbot:
67	```bash
68	# Install certbot
69	sudo apt install certbot
70
71	# Obtain certificate
72	sudo certbot certonly --standalone -d example.com -d www.example.com
73	# Certificates saved to /etc/letsencrypt/live/example.com/
74	```
75
76	### For Internal Services (Internal PKI)
77
78	Generate internal CA with CFSSL:
79
80	```bash
81	# Install CFSSL
82	brew install cfssl # macOS
83
84	# Create CA
85	cfssl genkey -initca ca-csr.json \| cfssljson -bare ca
86
87	# Generate server certificate
88	cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
89	-config=ca-config.json -profile=server \
90	server-csr.json \| cfssljson -bare server
91	```
92
93	See `examples/cfssl-ca/` for complete configuration files.
94
95	## TLS 1.3 Configuration Best Practices
96
97	### Protocol Versions
98
99	Enable TLS 1.3 and 1.2 only:
100	```nginx
101	# Nginx
102	ssl_protocols TLSv1.3 TLSv1.2;
103	ssl_prefer_server_ciphers off; # Let client choose
104	```
105
106	Disable obsolete protocols: SSLv3, TLS 1.0, TLS 1.1.
107
108	### Cipher Suites
109
110	TLS 1.3 (5 cipher suites):
111	```
112	TLS_AES_256_GCM_SHA384 # Recommended
113	TLS_CHACHA20_POLY1305_SHA256 # Mobile-optimized
114	TLS_AES_128_GCM_SHA256 # Performance
115	```
116
117	TLS 1.2 fallback:
118	```nginx
119	ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305';
120	```
121
122	### Security Features
123
124	- Perfect Forward Secrecy (PFS): Use ephemeral key exchanges (ECDHE)
125	- OCSP Stapling: Enable for performance and privacy
126	- HSTS: Force HTTPS with `Strict-Transport-Security` header
127	- Disable compression: Prevent CRIME attacks
128
129	For detailed TLS 1.3 configuration, see `references/tls13-best-practices.md`.
130
131	## Decision Framework
132
133	### Certificate Type Selection
134
135	```
136	Need TLS certificate?
137	│
138	├─ Public-facing (internet users)?
139	│ │
140	│ ├─ Single domain → Let's Encrypt with HTTP-01
141	│ │ Tools: certbot, cert-manager
142	│ │ Challenge: HTTP verification
143	│ │
144	│ └─ Multiple subdomains → Let's Encrypt with DNS-01
145	│ Tools: certbot with DNS plugin, cert-manager
146	│ Challenge: DNS TXT records
147	│ Supports: Wildcard certificates (*.example.com)
148	│
149	└─ Internal (corporate network)?
150	│
151	├─ Development → mkcert or self-signed
152	│ Tools: mkcert (trusted), openssl (basic)
153	│ No automation needed
154	│
155	└─ Production → Internal CA
156	│
157	├─ Small scale (<10 services) → CFSSL
158	│ Manual management acceptable
159	│
160	└─ Large scale (100+ services) → Vault PKI or cert-manager
161	Dynamic secrets, automatic rotation
162	```
163
164	### Automation Tool Selection
165
166	```
167	Environment?
168	│
169	├─ Kubernetes → cert-manager
170	│ Native CRDs, Ingress integration
171	│ Supports: Let's Encrypt, Vault, CA, self-signed
172	│
173	├─ Traditional servers (VMs) → Certbot (public) or CFSSL (internal)
174	│ Plugins: nginx, apache, DNS providers
175	│ Automated renewal via cron/systemd
176	│
177	├─ Microservices (any platform) → HashiCorp Vault PKI
178	│ Dynamic secrets, short-lived certs
179	│ API-driven, service mesh integration
180	│
181	└─ Developer workstation → mkcert
182	Trusted by browser automatically
183	```
184
185	### Standard TLS vs Mutual T

People who liked this also viewed

6 picks

Type