mtls-configuration Skill for Claude: What It Does and How to Install It

Makes Claude set up mutual TLS between services: Istio and Linkerd policies, cert-manager, SPIRE, rotation and debugging.

Installs: 10.5K; on skills.sh
Stars: 42.1K; on GitHub
Files: 1; besides SKILL.md
Updated: Oct 2026; last repo commit

This is an mTLS guide from wshobson's agents collection. SKILL.md shows the handshake between two sidecar proxies and a certificate hierarchy (root CA, intermediate CAs, workload certificates). Its do's and don'ts include starting with PERMISSIVE and moving to STRICT, and using workload certificates of 24 hours or less.

The five templates are in references/details.md: Istio strict mode, an Istio DestinationRule, cert-manager with Istio, SPIFFE/SPIRE and Linkerd. The same file covers certificate rotation and debugging.

Good for

Platform and security engineers moving to zero-trust networking
Teams migrating a mesh from permissive to strict mTLS
Operators who own certificate rotation
Engineers debugging TLS handshake failures

Install mtls-configuration

Claude Code

Copy this prompt.

Install the mtls-configuration skill in Claude Code. Run this command:

/plugin marketplace add wshobson/agents
/plugin install cloud-infrastructure@claude-code-workflows

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The plugin routes install the whole cloud-infrastructure plugin: 7 agents, 0 commands and 8 skills (counted from the plugin folder in the repo tree, which has no hooks or MCP config files). The skills-only routes install just this skill, with no agents or commands.

Built from the package data we hold. Not yet tested by us. Source.

What's in the skill

When it loads

Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.

Sections in SKILL.md

When to Use This Skill
Core Concepts
1. mTLS Flow
2. Certificate Hierarchy
Templates and detailed worked examples
Best Practices
Do's
Don'ts

Key facts

Author: wshobson (repo owner)
License: MIT
Installs on skills.sh: 10,539 (Nov 2, 2026)
GitHub stars: 42,081 for the whole wshobson/agents repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
What it includes: 2 files including SKILL.md: references/details.md (5 templates, rotation and debugging). No scripts
skills.sh audits: Gen Agent Trust Hub: pass; Socket: pass; Snyk: pass (Nov 2, 2026)
Part of: The cloud-infrastructure plugin (version 1.3.3) in wshobson/agents. Counted from the plugin folder: 7 agents, 0 commands and 8 skills
Works in: Claude Code, Codex CLI, Cursor, OpenCode, Antigravity CLI, GitHub Copilot and Pi, per the README. Skills-only installers ask which tool you use

What it includes

Handshake between two sidecar proxies, and root, intermediate and workload certs
mTLS flow and certificate hierarchy
5 do's and 4 don'ts, from starting in PERMISSIVE to verifying the full chain
Best practices
PeerAuthentication for the mesh, a namespace override and one workload
Write · Template 1: Istio strict mode
TLS and mutual TLS settings, including to an external service
Write · Template 2: Istio DestinationRule
ClusterIssuer, CA secret and a 24h workload Certificate
The template includes a Secret with base64 placeholders for the CA cert and key.
Write · Template 3: cert-manager with Istio
SPIRE server configuration and an abbreviated agent DaemonSet
Write · Template 4: SPIFFE/SPIRE
Linkerd turns mTLS on automatically; verify and opt a port out
Write · Template 5: Linkerd mTLS
Check expiry with istioctl, jq and openssl; restart a deployment to rotate
Uses kubectl rollout restart and linkerd identity.
Runs code · Certificate rotation
istioctl authn tls-check, policy listing, debug logs and Linkerd edges
Runs code · Debugging mTLS issues

From the official docs

Permissions

Medium risk

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

A CA private key goes into a secret
Template 3 builds an istio-ca-secret with a tls.key field. Use a secret store for real keys and never paste one into a chat or commit it. github.com
Strict mode can cut off services
Template 1 sets STRICT mTLS mesh-wide. SKILL.md advises starting with PERMISSIVE and migrating gradually. github.com
Rotation restarts a deployment
The rotation section forces new certificates with kubectl rollout restart deployment/my-app. Run it on a deployment you can safely restart. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. Use version control and review commands before they run.
Sign-in and keys	The skill has no account or key. Template 3 shows a Kubernetes Secret that holds a CA certificate and key.
Scopes	Claude can write PeerAuthentication, DestinationRule, cert-manager and SPIRE files in your project The rotation section runs kubectl rollout restart on a deployment The debugging section lists istioctl, kubectl and linkerd commands

Questions

How do I install mtls-configuration?

Use the install box at the top of this page. It offers the cloud-infrastructure plugin and two skills-only commands. Pick a skills-only command if you want just this skill without the plugin's other parts.

What does the mtls-configuration skill do?

It gives Claude patterns for mutual TLS between services in a mesh. Claude uses them to write Istio policies, cert-manager resources and SPIRE config, and to check certificates and TLS errors.

Does it cover Istio and Linkerd?

Yes. The details file has Istio templates (strict mode, DestinationRule, cert-manager), a SPIFFE/SPIRE template and a Linkerd one, where mTLS is automatic.

Should I go straight to strict mode?

SKILL.md says to start with PERMISSIVE and migrate gradually to STRICT. Template 1 shows a mesh-wide STRICT policy with a PERMISSIVE override for a legacy namespace.

Should I install the whole cloud-infrastructure plugin?

Only if you want the rest. The plugin folder holds 7 agents, 0 commands and 8 skills, counted from the repo tree, and the tree shows no hooks or MCP config files in it. The plugin's other skills include istio-traffic-management, linkerd-patterns and service-mesh-observability.

Is mtls-configuration safe to install?

The folder holds SKILL.md and one reference file, with no scripts. Claude writes certificate and policy YAML and may suggest the kubectl and istioctl commands in the file. Read each command, and keep real CA keys out of files and chat.

Does mtls-configuration work in Codex, Cursor or the Claude app?

The README documents Claude Code and Codex CLI plugin routes, and skills-only installs for the tools it lists: Cursor, OpenCode, Antigravity CLI, GitHub Copilot and Pi. We left the Claude app upload out of the install box because this skill's commands run in a terminal.

Information

updated Nov 2, 2026

Repository: wshobson/agents
Folder: plugins/cloud-infrastructure/skills/mtls-configuration

wshobson/agents skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3

mtls-configuration SKILL.md · github.com
mtls-configuration references/details.md · github.com
wshobson/agents README · github.com