mtls-configuration

Name: mtls-configuration
Author: wshobson

7.9kinstalls4.1kforks

How to install mtls-configuration?

wshobson/agents/mtls-configuration

$npx -y skills add wshobson/agents --skill mtls-configuration

Installs into the current project.

Summary

Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.

Files · 1

View on GitHub

SKILL.md

1	# mTLS Configuration
2
3	Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.
4
5	## When to Use This Skill
6
7	- Implementing zero-trust networking
8	- Securing service-to-service communication
9	- Certificate rotation and management
10	- Debugging TLS handshake issues
11	- Compliance requirements (PCI-DSS, HIPAA)
12	- Multi-cluster secure communication
13
14	## Core Concepts
15
16	### 1. mTLS Flow
17
18	```
19	┌─────────┐ ┌─────────┐
20	│ Service │ │ Service │
21	│ A │ │ B │
22	└────┬────┘ └────┬────┘
23	│ │
24	┌────┴────┐ TLS Handshake ┌────┴────┐
25	│ Proxy │◄───────────────────────────►│ Proxy │
26	│(Sidecar)│ 1. ClientHello │(Sidecar)│
27	│ │ 2. ServerHello + Cert │ │
28	│ │ 3. Client Cert │ │
29	│ │ 4. Verify Both Certs │ │
30	│ │ 5. Encrypted Channel │ │
31	└─────────┘ └─────────┘
32	```
33
34	### 2. Certificate Hierarchy
35
36	```
37	Root CA (Self-signed, long-lived)
38	│
39	├── Intermediate CA (Cluster-level)
40	│ │
41	│ ├── Workload Cert (Service A)
42	│ └── Workload Cert (Service B)
43	│
44	└── Intermediate CA (Multi-cluster)
45	│
46	└── Cross-cluster certs
47	```
48
49	## Templates and detailed worked examples
50
51	Full template library and detailed worked examples live in `references/details.md`. Read that file when you need the concrete templates.
52
53	## Best Practices
54
55	### Do's
56
57	- Start with PERMISSIVE - Migrate gradually to STRICT
58	- Monitor certificate expiry - Set up alerts
59	- Use short-lived certs - 24h or less for workloads
60	- Rotate CA periodically - Plan for CA rotation
61	- Log TLS errors - For debugging and audit
62
63	### Don'ts
64
65	- Don't disable mTLS - For convenience in production
66	- Don't ignore cert expiry - Automate rotation
67	- Don't use self-signed certs - Use proper CA hierarchy
68	- Don't skip verification - Verify the full chain

People who liked this also viewed

6 picks

Type

mtls-configuration

7.9kinstalls4.1kforks

View on GitHub

How to install mtls-configuration?

wshobson/agents/mtls-configuration

$npx -y skills add wshobson/agents --skill mtls-configuration

Installs into the current project.

Summary

Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.

Files · 1

View on GitHub

SKILL.md

1	# mTLS Configuration
2
3	Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.
4
5	## When to Use This Skill
6
7	- Implementing zero-trust networking
8	- Securing service-to-service communication
9	- Certificate rotation and management
10	- Debugging TLS handshake issues
11	- Compliance requirements (PCI-DSS, HIPAA)
12	- Multi-cluster secure communication
13
14	## Core Concepts
15
16	### 1. mTLS Flow
17
18	```
19	┌─────────┐ ┌─────────┐
20	│ Service │ │ Service │
21	│ A │ │ B │
22	└────┬────┘ └────┬────┘
23	│ │
24	┌────┴────┐ TLS Handshake ┌────┴────┐
25	│ Proxy │◄───────────────────────────►│ Proxy │
26	│(Sidecar)│ 1. ClientHello │(Sidecar)│
27	│ │ 2. ServerHello + Cert │ │
28	│ │ 3. Client Cert │ │
29	│ │ 4. Verify Both Certs │ │
30	│ │ 5. Encrypted Channel │ │
31	└─────────┘ └─────────┘
32	```
33
34	### 2. Certificate Hierarchy
35
36	```
37	Root CA (Self-signed, long-lived)
38	│
39	├── Intermediate CA (Cluster-level)
40	│ │
41	│ ├── Workload Cert (Service A)
42	│ └── Workload Cert (Service B)
43	│
44	└── Intermediate CA (Multi-cluster)
45	│
46	└── Cross-cluster certs
47	```
48
49	## Templates and detailed worked examples
50
51	Full template library and detailed worked examples live in `references/details.md`. Read that file when you need the concrete templates.
52
53	## Best Practices
54
55	### Do's
56
57	- Start with PERMISSIVE - Migrate gradually to STRICT
58	- Monitor certificate expiry - Set up alerts
59	- Use short-lived certs - 24h or less for workloads
60	- Rotate CA periodically - Plan for CA rotation
61	- Log TLS errors - For debugging and audit
62
63	### Don'ts
64
65	- Don't disable mTLS - For convenience in production
66	- Don't ignore cert expiry - Automate rotation
67	- Don't use self-signed certs - Use proper CA hierarchy
68	- Don't skip verification - Verify the full chain

People who liked this also viewed

6 picks

Type