mcpField
M
mtls-configuration

mtls-configuration

github.com/wshobsonSecurity41.9k10.5k installsUpdated 2w ago
Repository

About mtls-configuration

A guide to configuring mutual TLS for service meshes and zero-trust networking, intended for teams securing service-to-service communication. It covers certificate hierarchies, rotation, troubleshooting, and security practices.

Key features

  1. 01Explain mTLS handshakes and certificate hierarchies
  2. 02Guide certificate rotation and expiry monitoring
  3. 03Offer TLS troubleshooting guidance
  4. 04Describe migration from permissive to strict mode
  5. 05Cover certificate verification and auditing practices

Use cases

  1. 01Secure service-to-service communication
  2. 02Implement zero-trust networking
  3. 03Diagnose TLS handshake failures
  4. 04Manage certificate rotation and expiry
  5. 05Plan secure multi-cluster communication

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wshobson/agents --skill mtls-configuration

After installing, type/mtls-configurationin Claude Code to confirm it loaded.

Bundled filesreferences/details.md

Details

From the project README

mTLS Configuration

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

When to Use This Skill

  • Implementing zero-trust networking
  • Securing service-to-service communication
  • Certificate rotation and management
  • Debugging TLS handshake issues
  • Compliance requirements (PCI-DSS, HIPAA)
  • Multi-cluster secure communication

Core Concepts

1. mTLS Flow
┌─────────┐                              ┌─────────┐
│ Service │                              │ Service │
│    A    │                              │    B    │
└────┬────┘                              └────┬────┘
     │                                        │
┌────┴────┐      TLS Handshake          ┌────┴────┐
│  Proxy  │◄───────────────────────────►│  Proxy  │
│(Sidecar)│  1. ClientHello             │(Sidecar)│
│         │  2. ServerHello + Cert      │         │
│         │  3. Client Cert             │         │
│         │  4. Verify Both Certs       │         │
│         │  5. Encrypted Channel       │         │
└─────────┘                              └─────────┘
2. Certificate Hierarchy
Root CA (Self-signed, long-lived)
    │
    ├── Intermediate CA (Cluster-level)
    │       │
    │       ├── Workload Cert (Service A)
    │       └── Workload Cert (Service B)
    │
    └── Intermediate CA (Multi-cluster)
            │
            └── Cross-cluster certs

Templates and detailed worked examples

Full template library and detailed worked examples live in references/details.md. Read that file when you need the concrete templates.

Best Practices

Do's
  • Start with PERMISSIVE - Migrate gradually to STRICT
  • Monitor certificate expiry - Set up alerts
  • Use short-lived certs - 24h or less for workloads
  • Rotate CA periodically - Plan for CA rotation
  • Log TLS errors - For debugging and audit
Don'ts
  • Don't disable mTLS - For convenience in production
  • Don't ignore cert expiry - Automate rotation
  • Don't use self-signed certs - Use proper CA hierarchy
  • Don't skip verification - Verify the full chain

Comments

Markdown supported