Mtls Configuration
Unverified●30/40Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor◐PartialPlain prose you can paste in — but no Cursor rules file
Codex◐PartialPlain prose you can paste in — but no AGENTS.md
Gemini CLI◐PartialPlain prose you can paste in
Copilot◐PartialPlain prose you can paste in — but no Copilot instructions file
npx agentalley add mtls-configurationWho is stuck, and on what
Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.
The whole source
Frontmatter — 2 properties
| name | mtls-configuration |
|---|---|
| description | Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication. |
| 1 | --- |
| 2 | name: mtls-configuration |
| 3 | description: Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication. |
| 4 | ---A5 — No allowed-tools declared — no way to tell what this skill may touch |
| 5 | |
| 6 | # mTLS Configuration |
| 7 | |
| 8 | Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication. |
| 9 | |
| 10 | ## When to Use This Skill |
| 11 | |
| 12 | - Implementing zero-trust networking |
| 13 | - Securing service-to-service communication |
| 14 | - Certificate rotation and management |
| 15 | - Debugging TLS handshake issues |
| 16 | - Compliance requirements (PCI-DSS, HIPAA) |
| 17 | - Multi-cluster secure communication |
| 18 | |
| 19 | ## Core Concepts |
| 20 | |
| 21 | ### 1. mTLS Flow |
| 22 | |
| 23 | ``` |
| 24 | ┌─────────┐ ┌─────────┐ |
| 25 | │ Service │ │ Service │ |
| 26 | │ A │ │ B │ |
| 27 | └────┬────┘ └────┬────┘ |
| 28 | │ │ |
| 29 | ┌────┴────┐ TLS Handshake ┌────┴────┐ |
| 30 | │ Proxy │◄───────────────────────────►│ Proxy │ |
| 31 | │(Sidecar)│ 1. ClientHello │(Sidecar)│ |
| 32 | │ │ 2. ServerHello + Cert │ │ |
| 33 | │ │ 3. Client Cert │ │ |
| 34 | │ │ 4. Verify Both Certs │ │ |
| 35 | │ │ 5. Encrypted Channel │ │ |
| 36 | └─────────┘ └─────────┘ |
| 37 | ``` |
| 38 | |
| 39 | ### 2. Certificate Hierarchy |
| 40 | |
| 41 | ``` |
| 42 | Root CA (Self-signed, long-lived) |
| 43 | │ |
| 44 | ├── Intermediate CA (Cluster-level) |
| 45 | │ │ |
| 46 | │ ├── Workload Cert (Service A) |
| 47 | │ └── Workload Cert (Service B) |
| 48 | │ |
| 49 | └── Intermediate CA (Multi-cluster) |
| 50 | │ |
| 51 | └── Cross-cluster certs |
| 52 | ``` |
| 53 | |
| 54 | ## Templates and detailed worked examples |
| 55 | |
| 56 | Full template library and detailed worked examples live in `references/details.md`. Read that file when you need the concrete templates. |
| 57 | |
| 58 | ## Best Practices |
| 59 | |
| 60 | ### Do's |
| 61 | |
| 62 | - **Start with PERMISSIVE** - Migrate gradually to STRICT |
| 63 | - **Monitor certificate expiry** - Set up alerts |
| 64 | - **Use short-lived certs** - 24h or less for workloads |
| 65 | - **Rotate CA periodically** - Plan for CA rotation |
| 66 | - **Log TLS errors** - For debugging and audit |
| 67 | |
| 68 | ### Don'ts |
| 69 | |
| 70 | - **Don't disable mTLS** - For convenience in production |
| 71 | - **Don't ignore cert expiry** - Automate rotation |
| 72 | - **Don't use self-signed certs** - Use proper CA hierarchy |
| 73 | - **Don't skip verification** - Verify the full chain |
| 74 |
Reviews
Installed this one?Write the first review and take the Trailblazer badge.
Alternatives
Paper Poster (HTML): measurement-gated poster generationDEFAULT poster pipeline — build an academic conference poster (ICML/NeurIPS/ICLR/CVPR/...) as a single HTML/CSS file with measurement-driven hard gates, real paper figures, a two-hue design-token system, and print-ready PDF via headless Chromium. Use when the●····●36/40Brand Monitoring 📡Brand monitoring tool for tracking mentions across social media platforms. Monitor Reddit, Google News, YouTube, and DuckDuckGo for brand mentions. Includes sentiment analysis, trend tracking, crisis detection, and competitor comparison. No API key required fo◐····●34/40Spark Memory & Thermal OpsManage unified memory and thermals during long-running ML jobs on NVIDIA DGX Spark. Use when planning memory headroom for a training run on GB10, when a job OOMs on unified memory, or when monitoring temperature and power during multi-hour training.◐····●32/40Secrets ManagementImplement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.◐····●32/40