mtls-configuration

Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.

1.05x

Quality

59%

Does it follow best practices?

Impact

98%

1.05x

Average score across 6 eval scenarios

Securityby

Advisory

Suggest reviewing before use

Optimize this skill with Tessl

npx tessl skill review --optimize ./plugins/cloud-infrastructure/skills/mtls-configuration/SKILL.md

Evaluation results

100%

Zero-Trust Migration for a Fintech Service Mesh

Istio mTLS migration policy

Criteria

Without context

With context

Mesh-wide STRICT mode

100%

Legacy namespace PERMISSIVE

100%

Payment port STRICT

30%

100%

Metrics port disabled

100%

PeerAuthentication API version

100%

DestinationRule ISTIO_MUTUAL

100%

DestinationRule API version

100%

No production DISABLE

100%

Migration rationale documented

100%

workload selector present

100%

Automated Certificate Management for Healthcare Microservices

cert-manager certificate lifecycle

Criteria

Without context

With context

Short-lived duration

100%

Early renewBefore

100%

Server auth usage

100%

Client auth usage

100%

Short name DNS

100%

Namespace-qualified DNS

100%

FQDN DNS

100%

Uses ClusterIssuer

100%

CA-backed issuer

100%

Renewal rationale documented

100%

Certificate API version

100%

92%

Securing External API Connections and Diagnosing mTLS Failures

External service TLS modes and debugging

Criteria

Without context

With context

MUTUAL mode for partner API

100%

Client cert in MUTUAL

100%

Private key in MUTUAL

100%

CA certs in MUTUAL

100%

SIMPLE mode for analytics API

100%

CA certs in SIMPLE

No client certs in SIMPLE

100%

istioctl tls-check in runbook

100%

Cert expiry check in runbook

100%

Debug log level in runbook

100%

DestinationRule API version

100%

No DISABLE mode used

100%

19%

Linkerd Service Mesh Configuration for E-commerce Platform

Linkerd mTLS configuration and verification

Criteria

Without context

With context

skip-outbound-ports annotation

100%

Server resource present

60%

100%

Server podSelector

100%

Server proxyProtocol

100%

linkerd viz edges in runbook

100%

linkerd viz tap in runbook

100%

linkerd identity in runbook

50%

100%

No mTLS disabled in mesh

100%

Runbook documents mTLS status check

100%

Policy API version

100%

SPIFFE/SPIRE Zero-Trust Workload Identity for Kubernetes

SPIFFE/SPIRE workload identity configuration

Criteria

Without context

With context

trust_domain configured

100%

ca_ttl set to 168h

100%

default_x509_svid_ttl set to 1h

70%

100%

k8s_psat NodeAttestor

100%

service_account_allow_list

100%

sql DataStore plugin

100%

UpstreamAuthority disk plugin

100%

SPIRE Agent image version

100%

Agent socket mountPath

100%

Agent socket hostPath

100%

SPIRE in spire namespace

100%

mTLS Certificate Health Audit and Rotation Procedures

Certificate rotation and mTLS audit runbook

Criteria

Without context

With context

kubectl rollout restart for rotation

100%

istioctl proxy-config secret for expiry

80%

100%

kubectl get peerauthentication --all-namespaces

100%

kubectl get destinationrule --all-namespaces

100%

No self-signed issuers

100%

Proper CA hierarchy described

100%

TLS error logging mentioned

100%

Cert expiry alerting covered

100%

CA rotation addressed

100%

No mTLS disabled in production

100%

Automated rotation emphasized

100%

Repository: wshobson/agents
Commit: 70444e5

Evaluated: about 1 month ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Zero-Trust Migration for a Fintech Service Mesh Automated Certificate Management for Healthcare Microservices Securing External API Connections and Diagnosing mTLS Failures Linkerd Service Mesh Configuration for E-commerce Platform SPIFFE/SPIRE Zero-Trust Workload Identity for Kubernetes mTLS Certificate Health Audit and Rotation Procedures

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.