Mtls Configuration

by wshobson46891e7e60daNo licenseListed Oct 8, 2026Updated Oct 8, 2026

Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.

Instructions onlySecurity DevOps & Cloud

AI-generated overview

Guides implementing mutual TLS for zero-trust service-to-service communication, covering certificates, rotation and handshake debugging.

What it does: This skill provides guidance on configuring mutual TLS (mTLS) for zero-trust service-to-service communication. It explains the mTLS handshake flow, certificate hierarchy with root and intermediate CAs, and best practices for certificate rotation, expiry monitoring and TLS error logging. It points to a reference file containing templates and detailed worked examples.
When to use it: Use it when implementing zero-trust networking, securing internal service-to-service traffic, managing or rotating certificates, debugging TLS handshake problems, or meeting compliance requirements such as PCI-DSS and HIPAA.
Requirements: No scripts; instructions only. Reading the bundled reference file references/details.md is needed for the templates and worked examples.

mTLS Configuration

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

When to Use This Skill

Implementing zero-trust networking
Securing service-to-service communication
Certificate rotation and management
Debugging TLS handshake issues
Compliance requirements (PCI-DSS, HIPAA)
Multi-cluster secure communication

Core Concepts

1. mTLS Flow

┌─────────┐                              ┌─────────┐│ Service │                              │ Service ││    A    │                              │    B    │└────┬────┘                              └────┬────┘     │                                        │┌────┴────┐      TLS Handshake          ┌────┴────┐│  Proxy  │◄───────────────────────────►│  Proxy  ││(Sidecar)│  1. ClientHello             │(Sidecar)││         │  2. ServerHello + Cert      │         ││         │  3. Client Cert             │         ││         │  4. Verify Both Certs       │         ││         │  5. Encrypted Channel       │         │└─────────┘                              └─────────┘

┌─────────┐                              ┌─────────┐│ Service │                              │ Service ││    A    │                              │    B    │└────┬────┘                              └────┬────┘     │                                        │┌────┴────┐      TLS Handshake          ┌────┴────┐│  Proxy  │◄───────────────────────────►│  Proxy  ││(Sidecar)│  1. ClientHello             │(Sidecar)││         │  2. ServerHello + Cert      │         ││         │  3. Client Cert             │         ││         │  4. Verify Both Certs       │         ││         │  5. Encrypted Channel       │         │└─────────┘                              └─────────┘

2. Certificate Hierarchy

Root CA (Self-signed, long-lived)    │    ├── Intermediate CA (Cluster-level)    │       │    │       ├── Workload Cert (Service A)    │       └── Workload Cert (Service B)    │    └── Intermediate CA (Multi-cluster)            │            └── Cross-cluster certs

Root CA (Self-signed, long-lived)    │    ├── Intermediate CA (Cluster-level)    │       │    │       ├── Workload Cert (Service A)    │       └── Workload Cert (Service B)    │    └── Intermediate CA (Multi-cluster)            │            └── Cross-cluster certs

Templates and detailed worked examples

Full template library and detailed worked examples live in references/details.md. Read that file when you need the concrete templates.

Best Practices

Do's

Start with PERMISSIVE - Migrate gradually to STRICT
Monitor certificate expiry - Set up alerts
Use short-lived certs - 24h or less for workloads
Rotate CA periodically - Plan for CA rotation
Log TLS errors - For debugging and audit

Don'ts

Don't disable mTLS - For convenience in production
Don't ignore cert expiry - Automate rotation
Don't use self-signed certs - Use proper CA hierarchy
Don't skip verification - Verify the full chain

Source and attribution

Source:wshobson/agentsinplugins/cloud-infrastructure/skills/mtls-configurationat commit46891e7

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Mtls Configuration

mTLS Configuration

When to Use This Skill

Core Concepts

1. mTLS Flow

2. Certificate Hierarchy

Templates and detailed worked examples

Best Practices

Do's

Don'ts

Source and attribution

More from wshobson/agents

Uv Package Manager

Web Component Design

Python Type Safety

Visual Design Foundations

Responsive Design

Python Resource Management

More in Security

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt

Secops Cases

Iam Helper For Privileged Access Management