Mtls Configuration

From the author

Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.

— the description by Seth Hobson

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured approach to configuring mutual TLS (mTLS) for zero-trust networking. It covers the core concepts of mTLS flows and certificate hierarchies, while offering practical templates for Istio-based service meshes and SPIFFE/SPIRE integrations. It emphasizes best practices such as gradual migration using permissive modes, automated certificate rotation, and robust monitoring to ensure secure internal service communication.

What it does

Explains the mTLS handshake process between service proxies.
Defines best practices for certificate management and rotation.
Provides YAML templates for Istio PeerAuthentication and DestinationRules.
Offers configuration examples for integrating cert-manager with Istio.
Includes setup patterns for SPIFFE/SPIRE identity frameworks.
Outlines strategies for migrating to strict mTLS without service disruption.

When to use it

When implementing zero-trust networking architectures.
When securing internal service-to-service communication.
When managing certificate lifecycles and rotation policies.
When meeting compliance requirements like PCI-DSS or HIPAA.
When debugging TLS handshake or connectivity issues in a service mesh.

Advantages

Promotes a secure-by-default posture for internal traffic.
Supports gradual migration paths to minimize production impact.
Provides ready-to-use templates for common service mesh tools.
Encourages the use of short-lived certificates to reduce risk.

Usage examples

“How do I enable strict mTLS across my entire Istio mesh?”: The agent provides the PeerAuthentication YAML template with the mode set to STRICT for the istio-system namespace.
“What is the best way to migrate a legacy service to mTLS?”: The agent recommends starting with PERMISSIVE mode to allow both plaintext and mTLS traffic, then monitoring logs before switching to STRICT.
“Show me how to configure a DestinationRule for an external partner API.”: The agent provides a template using the MUTUAL TLS mode, including placeholders for client certificates, private keys, and CA certificates.
“How can I automate certificate rotation for my workloads?”: The agent provides a cert-manager ClusterIssuer configuration with defined duration and renewBefore parameters.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/wshobson/mtls-configuration/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip mtls-configuration.zip -d .agents/skills

Documentation by Seth Hobson

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

When to Use This Skill

Implementing zero-trust networking
Securing service-to-service communication
Certificate rotation and management
Debugging TLS handshake issues
Compliance requirements (PCI-DSS, HIPAA)
Multi-cluster secure communication

Core Concepts

1. mTLS Flow

┌─────────┐                              ┌─────────┐
│ Service │                              │ Service │
│    A    │                              │    B    │
└────┬────┘                              └────┬────┘
     │                                        │
┌────┴────┐      TLS Handshake          ┌────┴────┐
│  Proxy  │◄───────────────────────────►│  Proxy  │
│(Sidecar)│  1. ClientHello             │(Sidecar)│
│         │  2. ServerHello + Cert      │         │
│         │  3. Client Cert             │         │
│         │  4. Verify Both Certs       │         │
│         │  5. Encrypted Channel       │         │
└─────────┘                              └─────────┘

2. Certificate Hierarchy

Root CA (Self-signed, long-lived)
    │
    ├── Intermediate CA (Cluster-level)
    │       │
    │       ├── Workload Cert (Service A)
    │       └── Workload Cert (Service B)
    │
    └── Intermediate CA (Multi-cluster)
            │
            └── Cross-cluster certs

Templates and detailed worked examples

Full template library and detailed worked examples live in references/details.md. Read that file when you need the concrete templates.

Best Practices

Do's

Start with PERMISSIVE - Migrate gradually to STRICT
Monitor certificate expiry - Set up alerts
Use short-lived certs - 24h or less for workloads
Rotate CA periodically - Plan for CA rotation
Log TLS errors - For debugging and audit

Don'ts

Don't disable mTLS - For convenience in production
Don't ignore cert expiry - Automate rotation
Don't use self-signed certs - Use proper CA hierarchy
Don't skip verification - Verify the full chain

Files

ATTRIBUTION.mdAdded by AutoGineer994 B
LICENSELicence file added by AutoGineer1.0 KiB
SKILL.md2.6 KiB
references/details.md5.7 KiB

SKILL.md