AutoGineer
Generated banner for Mtls Configuration
Generated logo for Mtls Configuration

Mtls Configuration

Seth HobsonCommunityCreated by Seth Hobson

  • Skill
  • Guidelines
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.
— the description by Seth Hobson

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured approach to configuring mutual TLS (mTLS) for zero-trust networking. It covers the core concepts of mTLS flows and certificate hierarchies, while offering practical templates for Istio-based service meshes and SPIFFE/SPIRE integrations. It emphasizes best practices such as gradual migration using permissive modes, automated certificate rotation, and robust monitoring to ensure secure internal service communication.

What it does

  • Explains the mTLS handshake process between service proxies.
  • Defines best practices for certificate management and rotation.
  • Provides YAML templates for Istio PeerAuthentication and DestinationRules.
  • Offers configuration examples for integrating cert-manager with Istio.
  • Includes setup patterns for SPIFFE/SPIRE identity frameworks.
  • Outlines strategies for migrating to strict mTLS without service disruption.

When to use it

  • When implementing zero-trust networking architectures.
  • When securing internal service-to-service communication.
  • When managing certificate lifecycles and rotation policies.
  • When meeting compliance requirements like PCI-DSS or HIPAA.
  • When debugging TLS handshake or connectivity issues in a service mesh.

Advantages

  • Promotes a secure-by-default posture for internal traffic.
  • Supports gradual migration paths to minimize production impact.
  • Provides ready-to-use templates for common service mesh tools.
  • Encourages the use of short-lived certificates to reduce risk.

Usage examples

“How do I enable strict mTLS across my entire Istio mesh?”
The agent provides the PeerAuthentication YAML template with the mode set to STRICT for the istio-system namespace.
“What is the best way to migrate a legacy service to mTLS?”
The agent recommends starting with PERMISSIVE mode to allow both plaintext and mTLS traffic, then monitoring logs before switching to STRICT.
“Show me how to configure a DestinationRule for an external partner API.”
The agent provides a template using the MUTUAL TLS mode, including placeholders for client certificates, private keys, and CA certificates.
“How can I automate certificate rotation for my workloads?”
The agent provides a cert-manager ClusterIssuer configuration with defined duration and renewBefore parameters.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/wshobson/mtls-configuration/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip mtls-configuration.zip -d .agents/skills

Documentation by Seth Hobson

mTLS Configuration

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

When to Use This Skill

  • Implementing zero-trust networking

  • Securing service-to-service communication

  • Certificate rotation and management

  • Debugging TLS handshake issues

  • Compliance requirements (PCI-DSS, HIPAA)

  • Multi-cluster secure communication

Core Concepts

1. mTLS Flow
┌─────────┐                              ┌─────────┐
│ Service │                              │ Service │
│    A    │                              │    B    │
└────┬────┘                              └────┬────┘
     │                                        │
┌────┴────┐      TLS Handshake          ┌────┴────┐
│  Proxy  │◄───────────────────────────►│  Proxy  │
│(Sidecar)│  1. ClientHello             │(Sidecar)│
│         │  2. ServerHello + Cert      │         │
│         │  3. Client Cert             │         │
│         │  4. Verify Both Certs       │         │
│         │  5. Encrypted Channel       │         │
└─────────┘                              └─────────┘
2. Certificate Hierarchy
Root CA (Self-signed, long-lived)
    │
    ├── Intermediate CA (Cluster-level)
    │       │
    │       ├── Workload Cert (Service A)
    │       └── Workload Cert (Service B)
    │
    └── Intermediate CA (Multi-cluster)
            │
            └── Cross-cluster certs

Templates and detailed worked examples

Full template library and detailed worked examples live in references/details.md. Read that file when you need the concrete templates.

Best Practices

Do's

  • Start with PERMISSIVE - Migrate gradually to STRICT

  • Monitor certificate expiry - Set up alerts

  • Use short-lived certs - 24h or less for workloads

  • Rotate CA periodically - Plan for CA rotation

  • Log TLS errors - For debugging and audit

Don'ts

  • Don't disable mTLS - For convenience in production

  • Don't ignore cert expiry - Automate rotation

  • Don't use self-signed certs - Use proper CA hierarchy

  • Don't skip verification - Verify the full chain

Files

LICENSE

MIT License

Copyright (c) 2024 Seth Hobson

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Seth Hobson
Publisher
Seth Hobson (Community)
Source
wshobson/agents · plugins/cloud-infrastructure/skills/mtls-configuration · commit 4bde316
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Seth Hobson or Seth Hobson.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download mtls-configuration.zip