Configure mutual TLS for zero-trust service-to-service

Mtls configuration

by wshobson · MIT license · ★ 39,857 on GitHub · updated Sep 21

Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.

---
name: mtls-configuration
description: Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.
---

# mTLS Configuration

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

## When to Use This Skill

- Implementing zero-trust networking
- Securing service-to-service communication
- Certificate rotation and management
- Debugging TLS handshake issues
- Compliance requirements (PCI-DSS, HIPAA)
- Multi-cluster secure communication

Overview

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

Manual install (npx, ZIP)

Claude Codenpx skills add wshobson/agents --skill mtls-configuration -g -a claude-code

Claude Code (manual)

mkdir -p ~/.claude/skills && curl -sL https://codeload.github.com/wshobson/agents/tar.gz/4236bb91f839 \
  | tar -xz -C ~/.claude/skills --strip-components=4 agents-4236bb91f839/plugins/cloud-infrastructure/skills/mtls-configuration

Windows (PowerShell)

New-Item -ItemType Directory -Force "$HOME\.claude\skills" | Out-Null; Invoke-WebRequest "https://m.agentalley.io/zip/567b902b08b2c05f2103/mtls-configuration.zip" -OutFile "$env:TEMP\mtls-configuration.zip"; Expand-Archive "$env:TEMP\mtls-configuration.zip" -DestinationPath "$HOME\.claude\skills" -Force

Claude.ai / desktopDownload the ZIP and upload it under Settings → Capabilities → Skills.

Codex, Cursor, other agentsPoint them at SKILL.md. The other files are plain text.

Connects with Agent Alley MCP · agentalley.io/mcp

Files included

SKILL.md2.6 KB
references/1 file · 5.7 KB

Read the files here

wshobson/4236bb92 files

SKILL.md2.6 KB

SKILL.md

Show the full text74 lines

mtls-configuration/SKILL.md74 lines · 2.6 KB

PreviewCode

Outline

RawView on GitHub

mTLS Configuration

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

When to Use This Skill

Implementing zero-trust networking
Securing service-to-service communication
Certificate rotation and management
Debugging TLS handshake issues
Compliance requirements (PCI-DSS, HIPAA)
Multi-cluster secure communication

Core Concepts

1. mTLS Flow

┌─────────┐                              ┌─────────┐
│ Service │                              │ Service │
│    A    │                              │    B    │
└────┬────┘                              └────┬────┘
     │                                        │
┌────┴────┐      TLS Handshake          ┌────┴────┐
│  Proxy  │◄───────────────────────────►│  Proxy  │
│(Sidecar)│  1. ClientHello             │(Sidecar)│
│         │  2. ServerHello + Cert      │         │
│         │  3. Client Cert             │         │
│         │  4. Verify Both Certs       │         │
│         │  5. Encrypted Channel       │         │
└─────────┘                              └─────────┘

2. Certificate Hierarchy

Root CA (Self-signed, long-lived)
    │
    ├── Intermediate CA (Cluster-level)
    │       │
    │       ├── Workload Cert (Service A)
    │       └── Workload Cert (Service B)
    │
    └── Intermediate CA (Multi-cluster)
            │
            └── Cross-cluster certs

Templates and detailed worked examples

Full template library and detailed worked examples live in references/details.md. Read that file when you need the concrete templates.

Best Practices

Do's

Start with PERMISSIVE - Migrate gradually to STRICT
Monitor certificate expiry - Set up alerts
Use short-lived certs - 24h or less for workloads
Rotate CA periodically - Plan for CA rotation
Log TLS errors - For debugging and audit

Don'ts

Don't disable mTLS - For convenience in production
Don't ignore cert expiry - Automate rotation
Don't use self-signed certs - Use proper CA hierarchy
Don't skip verification - Verify the full chain

1	---
2	name: mtls-configuration
3	description: Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.
4	---
5
6	# mTLS Configuration
7
8	Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.
9
10	## When to Use This Skill
11
12	- Implementing zero-trust networking
13	- Securing service-to-service communication
14	- Certificate rotation and management
15	- Debugging TLS handshake issues
16	- Compliance requirements (PCI-DSS, HIPAA)
17	- Multi-cluster secure communication
18
19	## Core Concepts
20
21	### 1. mTLS Flow
22
23	```
24	┌─────────┐ ┌─────────┐
25	│ Service │ │ Service │
26	│ A │ │ B │
27	└────┬────┘ └────┬────┘
28	│ │
29	┌────┴────┐ TLS Handshake ┌────┴────┐
30	│ Proxy │◄───────────────────────────►│ Proxy │
31	│(Sidecar)│ 1. ClientHello │(Sidecar)│
32	│ │ 2. ServerHello + Cert │ │
33	│ │ 3. Client Cert │ │
34	│ │ 4. Verify Both Certs │ │
35	│ │ 5. Encrypted Channel │ │
36	└─────────┘ └─────────┘
37	```
38
39	### 2. Certificate Hierarchy
40
41	```
42	Root CA (Self-signed, long-lived)
43	│
44	├── Intermediate CA (Cluster-level)
45	│ │
46	│ ├── Workload Cert (Service A)
47	│ └── Workload Cert (Service B)
48	│
49	└── Intermediate CA (Multi-cluster)
50	│
51	└── Cross-cluster certs
52	```
53
54	## Templates and detailed worked examples
55
56	Full template library and detailed worked examples live in `references/details.md`. Read that file when you need the concrete templates.
57
58	## Best Practices
59
60	### Do's
61
62	- Start with PERMISSIVE - Migrate gradually to STRICT
63	- Monitor certificate expiry - Set up alerts
64	- Use short-lived certs - 24h or less for workloads
65	- Rotate CA periodically - Plan for CA rotation
66	- Log TLS errors - For debugging and audit
67
68	### Don'ts
69
70	- Don't disable mTLS - For convenience in production
71	- Don't ignore cert expiry - Automate rotation
72	- Don't use self-signed certs - Use proper CA hierarchy
73	- Don't skip verification - Verify the full chain
74