# Configure Mutual TLS for Service Meshes

Service-to-service encryption is difficult to configure consistently across mesh platforms. This skill provides mTLS templates, certificate guidance, verification commands, and troubleshooting steps.

## Install

```bash
npx skillstore add sickn33/mtls-configuration
```

## Metadata

- Status: approved
- Slug: sickn33-mtls-configuration
- Skillstore revision: r2
- Version status: missing
- Tree hash: adb9d7aabd05ba00a214c2ad43a4fcd0846f4650c57725f32f0886f500d0ac2a
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/mtls-configuration
- Ref: 81e05e636292629114b76cbb3922fbe57672fc02
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-mtls-configuration
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-mtls-configuration/manifest

## Capabilities

- Explains the mutual TLS handshake and certificate hierarchy.
- Provides Istio PeerAuthentication and DestinationRule templates.
- Shows cert-manager certificate issuance patterns for Istio workloads.
- Provides an abbreviated SPIFFE and SPIRE deployment example.
- Includes Linkerd configuration and certificate inspection commands.
- Lists commands for diagnosing mesh authentication and TLS failures.

## Use Cases

- Enforce Istio mTLS: Create strict mesh and workload authentication policies with controlled migration settings.
- Operate Workload Certificates: Plan certificate issuance, renewal, rotation, and trust hierarchy for Kubernetes services.
- Diagnose TLS Failures: Inspect mesh policies, proxy certificates, identities, logs, and service connections.

## Prompt Templates

### Explain mTLS

```
Explain mutual TLS for two Kubernetes services. Describe identity verification, certificate trust, and encrypted communication.
```

### Create an Istio Policy

```
Create an Istio strict mTLS policy for namespace [namespace] and workload [workload]. Include verification steps and rollback guidance.
```

### Plan Certificate Rotation

```
Design certificate rotation for [platform] with [certificate lifetime]. Include renewal timing, monitoring, failure handling, and CA rotation.
```

### Review a Multi-Cluster Design

```
Review this multi-cluster mTLS design: [design]. Identify trust boundaries, bypasses, key risks, observability gaps, and validation tests.
```

## Limitations

- Examples require adaptation to cluster names, namespaces, identities, and trust domains.
- The referenced implementation playbook is not included in the reported file structure.
- The skill does not deploy resources or verify a live cluster.
- Production certificate storage and access controls require environment-specific security review.

## Best Practices

- Start migration in permissive mode, measure plaintext traffic, then enforce strict mode with a deadline.
- Use short-lived workload certificates and monitor renewal failures before expiration.
- Protect CA keys with strong access controls, encryption, auditing, and regular rotation.

## Anti Patterns

- Do not disable mutual TLS on production ports without documented compensating controls.
- Do not store real private keys in prompts, repositories, logs, or unencrypted configuration.
- Do not apply generic templates before validating identities, ports, namespaces, and trust boundaries.

## Security Audit

- Audited at: 2026-08-04T15:04:28.777\+00:00
- Summary: Most static alerts are false positives caused by Markdown fences, example paths, placeholders, and reference links. The review confirms an all-interface bind and identifies unsafe mTLS bypass examples and insufficient CA key protection guidance.

## Stats

- Views: 103
- Downloads: 11
- Favorites: 0
- Popularity score: 0