Name: mtls-configuration
Author: wshobson

Imported from wshobson/agents (plugins/cloud-infrastructure/skills/mtls-configuration/SKILL.md) via skills.sh. Install upstream with npx skills add wshobson/agents --skill mtls-configuration. Copyright stays with the author.

mTLS Configuration

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

When to Use This Skill

Implementing zero-trust networking
Securing service-to-service communication
Certificate rotation and management
Debugging TLS handshake issues
Compliance requirements (PCI-DSS, HIPAA)
Multi-cluster secure communication

Core Concepts

1. mTLS Flow

┌─────────┐                              ┌─────────┐
│ Service │                              │ Service │
│    A    │                              │    B    │
└────┬────┘                              └────┬────┘
     │                                        │
┌────┴────┐      TLS Handshake          ┌────┴────┐
│  Proxy  │◄───────────────────────────►│  Proxy  │
│(Sidecar)│  1. ClientHello             │(Sidecar)│
│         │  2. ServerHello + Cert      │         │
│         │  3. Client Cert             │         │
│         │  4. Verify Both Certs       │         │
│         │  5. Encrypted Channel       │         │
└─────────┘                              └─────────┘

2. Certificate Hierarchy

Root CA (Self-signed, long-lived)
    │
    ├── Intermediate CA (Cluster-level)
    │       │
    │       ├── Workload Cert (Service A)
    │       └── Workload Cert (Service B)
    │
    └── Intermediate CA (Multi-cluster)
            │
            └── Cross-cluster certs

Templates and detailed worked examples

Full template library and detailed worked examples live in references/details.md. Read that file when you need the concrete templates.

Best Practices

Do's

Start with PERMISSIVE - Migrate gradually to STRICT
Monitor certificate expiry - Set up alerts
Use short-lived certs - 24h or less for workloads
Rotate CA periodically - Plan for CA rotation
Log TLS errors - For debugging and audit

Don'ts

Don't disable mTLS - For convenience in production
Don't ignore cert expiry - Automate rotation
Don't use self-signed certs - Use proper CA hierarchy
Don't skip verification - Verify the full chain

Install mtls-configuration and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "wshobson-agents-mtls-configuration", "kind": "skill", "name": "mtls-configuration", "description": "Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.", "publisher": "wshobson", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/wshobson/agents", "path": "plugins/cloud-infrastructure/skills/mtls-configuration/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/wshobson/agents/mtls-configuration", "key": "wshobson/agents/plugins/cloud-infrastructure/skills/mtls-configuration/SKILL.md" } }, "instructions": "# mTLS Configuration\n\nComprehensive guide to implementing mutual TLS for zero-trust service mesh communication.\n\n## When to Use This Skill\n\n- Implementing zero-trust networking\n- Securing service-to-service communication\n- Certificate rotation and management\n- Debugging TLS handshake issues\n- Compliance requirements (PCI-DSS, HIPAA)\n- Multi-cluster secure communication\n\n## Core Concepts\n\n### 1. mTLS Flow\n\n```\n┌─────────┐ ┌─────────┐\n│ Service │ │ Service │\n│ A │ │ B │\n└────┬────┘ ", "cost": { "context_tokens": 528 } }

mtls-configuration

About