# Mtls Configuration

> Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.

Source: https://skillsagentes.com/skills/wshobson/agents/mtls-configuration
Repository: https://github.com/wshobson/agents
Author: wshobson
License: MIT
Updated: hace 2 meses
Context cost: 47 tok installed, 675 tok once triggered, 2.1k tok with every bundled file
Bundle: 2 files, 8 KB
Permissions requested: none declared

## Install

```bash
npx -y skills add wshobson/agents --skill mtls-configuration --agent claude-code
```

## What it does

- Guía para configurar mTLS en comunicación zero-trust entre servicios
- Explica el flujo de handshake TLS mutuo entre sidecars/proxies
- Define jerarquía de certificados (Root CA, Intermediate CA, Workload Certs)
- Da buenas prácticas de rotación, expiración y verificación de certificados

## Use it when

- Implementar redes zero-trust
- Asegurar comunicación entre servicios
- Rotación y gestión de certificados
- Depurar problemas de handshake TLS

## What triggers it

- "Configura mTLS entre mis servicios en el service mesh"
- "Ayúdame a implementar zero-trust networking con certificados"
- "Necesito rotar certificados de servicios sin downtime"
- "Cómo depuro un error de handshake TLS entre sidecars"

## Before you install

- Requiere plantillas y ejemplos detallados en references/details.md para configuraciones concretas.

## Files

- SKILL.md — 3 KB
- references/details.md — 6 KB

## SKILL.md

Reproduced verbatim from wshobson/agents under MIT. This section is the upstream document and is in English.

# mTLS Configuration

Comprehensive guide to implementing mutual TLS for zero-trust service mesh communication.

## When to Use This Skill

- Implementing zero-trust networking
- Securing service-to-service communication
- Certificate rotation and management
- Debugging TLS handshake issues
- Compliance requirements (PCI-DSS, HIPAA)
- Multi-cluster secure communication

## Core Concepts

### 1. mTLS Flow

```
┌─────────┐                              ┌─────────┐
│ Service │                              │ Service │
│    A    │                              │    B    │
└────┬────┘                              └────┬────┘
     │                                        │
┌────┴────┐      TLS Handshake          ┌────┴────┐
│  Proxy  │◄───────────────────────────►│  Proxy  │
│(Sidecar)│  1. ClientHello             │(Sidecar)│
│         │  2. ServerHello + Cert      │         │
│         │  3. Client Cert             │         │
│         │  4. Verify Both Certs       │         │
│         │  5. Encrypted Channel       │         │
└─────────┘                              └─────────┘
```

### 2. Certificate Hierarchy

```
Root CA (Self-signed, long-lived)
    │
    ├── Intermediate CA (Cluster-level)
    │       │
    │       ├── Workload Cert (Service A)
    │       └── Workload Cert (Service B)
    │
    └── Intermediate CA (Multi-cluster)
            │
            └── Cross-cluster certs
```

## Templates and detailed worked examples

Full template library and detailed worked examples live in `references/details.md`. Read that file when you need the concrete templates.

## Best Practices

### Do's

- **Start with PERMISSIVE** - Migrate gradually to STRICT
- **Monitor certificate expiry** - Set up alerts
- **Use short-lived certs** - 24h or less for workloads
- **Rotate CA periodically** - Plan for CA rotation
- **Log TLS errors** - For debugging and audit

### Don'ts

- **Don't disable mTLS** - For convenience in production
- **Don't ignore cert expiry** - Automate rotation
- **Don't use self-signed certs** - Use proper CA hierarchy
- **Don't skip verification** - Verify the full chain

---

Skills Agentes — https://skillsagentes.com/skills/wshobson/agents/mtls-configuration