{"id":"mtls-configuration","name":"mtls-configuration","summary":"ゼロトラストのサービス間通信のために相互TLS(mTLS)を設定しましょう。ゼロトラストネットワーキングの実装、証明書管理、または内部サービス通信の安全確保に使用します。","body":"# mTLS Configuration\n\nComprehensive guide to implementing mutual TLS for zero-trust service mesh communication.\n\n## When to Use This Skill\n\n- Implementing zero-trust networking\n- Securing service-to-service communication\n- Certificate rotation and management\n- Debugging TLS handshake issues\n- Compliance requirements (PCI-DSS, HIPAA)\n- Multi-cluster secure communication\n\n## Core Concepts\n\n### 1. mTLS Flow\n\n```\n┌─────────┐                              ┌─────────┐\n│ Service │                              │ Service │\n│    A    │                              │    B    │\n└────┬────┘                              └────┬────┘\n     │                                        │\n┌────┴────┐      TLS Handshake          ┌────┴────┐\n│  Proxy  │◄───────────────────────────►│  Proxy  │\n│(Sidecar)│  1. ClientHello             │(Sidecar)│\n│         │  2. ServerHello + Cert      │         │\n│         │  3. Client Cert             │         │\n│         │  4. Verify Both Certs       │         │\n│         │  5. Encrypted Channel       │         │\n└─────────┘                              └─────────┘\n```\n\n### 2. Certificate Hierarchy\n\n```\nRoot CA (Self-signed, long-lived)\n    │\n    ├── Intermediate CA (Cluster-level)\n    │       │\n    │       ├── Workload Cert (Service A)\n    │       └── Workload Cert (Service B)\n    │\n    └── Intermediate CA (Multi-cluster)\n            │\n            └── Cross-cluster certs\n```\n\n## Templates and detailed worked examples\n\nFull template library and detailed worked examples live in `references/details.md`. Read that file when you need the concrete templates.\n\n## Best Practices\n\n### Do's\n\n- **Start with PERMISSIVE** - Migrate gradually to STRICT\n- **Monitor certificate expiry** - Set up alerts\n- **Use short-lived certs** - 24h or less for workloads\n- **Rotate CA periodically** - Plan for CA rotation\n- **Log TLS errors** - For debugging and audit\n\n### Don'ts\n\n- **Don't disable mTLS** - For convenience in production\n- **Don't ignore cert expiry** - Automate rotation\n- **Don't use self-signed certs** - Use proper CA hierarchy\n- **Don't skip verification** - Verify the full chain","author":"@wshobson","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/wshobson/agents/tree/main/plugins/cloud-infrastructure/skills/mtls-configuration","license":"MIT","category":null,"lang":"en","tokens":542,"stars":0,"calls30d":2,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[{"path":"references/details.md","size":5807,"sha256":"f5c1f3d385dafcf02a1c4a55c7ec66758eac7e773f996073bcd6d62fce56a942"}],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":[]}}