Back to catalog / Security
Service-to-service mTLS and certificate rotation
Authenticate and encrypt service links with a plan for issuance, rotation, and recovery.
Skills
Map service identities and trust boundaries, choose an issuer such as Istio, cert-manager, or a cloud service, and assign least-privilege workload identities. Verify TLS mode, trust roots, SANs, and validity; configure rotation and expiry alerts. Test overlap, revocation, and recovery on a non-production service before enforcing strict validation and monitoring handshake failures.
Permissions
Prerequisites
- Needs service identities, a PKI/issuer, and trust roots; establish rollback and out-of-band access first.
Permissions
- May inspect certificate configuration and propose policy; issuing/revoking certificates or enforcing TLS needs security/operations approval.
Limitations
Expired certificates or bad trust chains can break service traffic; test rotation and client compatibility first.
Pinned upstream source
- Repository
- wshobson/agents
- File path
- plugins/cloud-infrastructure/skills/mtls-configuration/SKILL.md
- Pinned commit
46891e7e60da0e52baf1050b7b6391b64e84c6d9- Source checked
- 2026-10-14 · Reviewed against the pinned upstream source
Repository metrics
These values describe the upstream repository, not popularity or likes for an individual skill or playbook.
- Stars
- Not collected
- Forks
- Not collected
- Observed at
- Not collected
No metrics snapshot is available yet.
License: MIT
Compatible tools
Istio/cert-manager · cloud certificate service · Kubernetes
Main topic
Make Agent behavior safer and easier to verify