Mtls Configuration

Solid reference for implementing mutual TLS across service meshes, with working configs for Istio, Linkerd, and SPIFFE/SPIRE. The debugging section actually helps when TLS handshakes fail, showing specific istioctl commands to check certificate status and peer authentication policies. Templates cover the migration path from PERMISSIVE to STRICT mode that most teams need. Certificate rotation examples are practical, including the base64 decode pipeline to check expiry dates. Best practices section cuts through the usual security theater to focus on operational concerns like short-lived certificates and proper CA hierarchy.

skills.sh installs: 10.7K
GitHub stars: 42.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add wshobson/agents --skill mtls-configuration --agent claude-code

Installs into .claude/skills of the current project.

Files

mTLS Configuration

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

When to Use This Skill

Implementing zero-trust networking
Securing service-to-service communication
Certificate rotation and management
Debugging TLS handshake issues
Compliance requirements (PCI-DSS, HIPAA)
Multi-cluster secure communication

Core Concepts

1. mTLS Flow

┌─────────┐                              ┌─────────┐
│ Service │                              │ Service │
│    A    │                              │    B    │
└────┬────┘                              └────┬────┘
     │                                        │
┌────┴────┐      TLS Handshake          ┌────┴────┐
│  Proxy  │◄───────────────────────────►│  Proxy  │
│(Sidecar)│  1. ClientHello             │(Sidecar)│
│         │  2. ServerHello + Cert      │         │
│         │  3. Client Cert             │         │
│         │  4. Verify Both Certs       │         │
│         │  5. Encrypted Channel       │         │
└─────────┘                              └─────────┘