Skip to content
Get packs

mTLS Configuration Guide

Guides an agent through setting up mutual TLS for zero-trust service-to-service traffic

Source Download skill
Repository
wshobson/agents
Stars
42,095
Licence
MIT
Files
2 files

What it does

When installed, the agent gains a structured playbook for mutual TLS, a setup where both sides of a connection between internal services prove their identity with certificates before any data flows. It explains the handshake flow, how a certificate hierarchy (root CA, intermediate CAs, workload certificates) should be organised, and recommended practices such as starting in permissive mode, using short-lived certificates, and monitoring expiry. It points to a reference file with templates and worked examples for when concrete configuration is needed.

Great for

  • Platform or DevOps engineers rolling out zero-trust networking between microservices
  • Teams preparing for compliance reviews (for example PCI-DSS or HIPAA) that require encrypted internal traffic
  • Engineers debugging TLS handshake failures between services

Skip it if

  • Simple single-service apps with no internal traffic, where mTLS adds complexity without benefit
  • Anyone applying generated configs to production without review, since the guidance is generic and must be adapted to the actual mesh, CA and cluster setup

Try asking

  • “Help me plan an mTLS rollout from permissive to strict across my Kubernetes services”
  • “Explain how to structure a root CA and intermediate CAs for multi-cluster service communication”
  • “Why is my service getting a TLS handshake error after enabling client certificates?”
  • “Create a certificate rotation plan with short-lived workload certificates”
Step-by-step guide: how to use mTLS Configuration GuideInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    mtls-configuration.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip mtls-configuration.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip mtls-configuration.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Ask for the specific mesh or tool you use (Istio, Linkerd, cert-manager, plain Envoy) so the agent pulls the matching templates from the reference file.
  • Review any generated certificate or policy configuration with your security team before deploying, and test in a non-production cluster first.
  • Describe your current state (existing certificates, mesh version, PERMISSIVE or STRICT mode) so the advice fits your migration stage.

What's inside

  • references/details.md
  • SKILL.md

Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.