skills.rest
masermediagroup-stack
masermediagroup-stackCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-tls

Configure TLS certificates, mutual TLS, and automated certificate lifecycle management for secure communications.

1|Updated Feb 24, 2026
Search Tags:#mtls#ssl certificates#tls#openssl#pki#cert-manager#lets encrypt
One-click install
npx skills add https://github.com/masermediagroup-stack/maser-media --skill implementing-tls-masermediagroup-stack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-tls
Source: https://github.com/masermediagroup-stack/maser-media/tree/main/.cursor/skills/community/ai-design-components/skills/implementing-tls
Command: npx skills add https://github.com/masermediagroup-stack/maser-media --skill implementing-tls-masermediagroup-stack

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Setting up HTTPS, securing service-to-service communication, and managing certificate lifecycles involves complex tooling choices and error-prone manual steps. This Skill provides decision frameworks, working configurations, and debugging procedures for TLS implementation across development, production, and internal PKI environments. ## Core Features & Use Cases - Certificate Generation: Create self-signed certificates with OpenSSL, trusted local certificates with mkcert, and internal CA hierarchies with CFSSL. - Automation: Automate Let's Encrypt issuance and renewal with Certbot on VMs or cert-manager in Kubernetes, plus dynamic short-lived certificates via HashiCorp Vault PKI. - Mutual TLS (mTLS): Configure bidirectional certificate authentication with Nginx, application code examples in Go/Python/Node.js, and service mesh integration with Istio or Linkerd. - Use Case: A platform engineer needs to secure a new microservices deployment. They use the decision framework to select cert-manager with an internal CA, apply the provided Kubernetes manifests, and configure strict mTLS via Istio PeerAuthentication. ## Quick Start Ask the agent to set up HTTPS for your domain using Let's Encrypt with cert-manager on Kubernetes, or generate trusted local development certificates with mkcert.

Frequently Asked Questions about implementing-tls

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up HTTPS with Let's Encrypt certificates?▼

Use Certbot on traditional servers with certbot certonly --standalone or --webroot, or cert-manager in Kubernetes with a ClusterIssuer pointing to the Let's Encrypt ACME server. Both approaches support automatic renewal before the 90-day expiry.

What is the difference between standard TLS and mutual TLS?▼

Standard TLS authenticates only the server to the client, while mutual TLS requires both parties to present certificates. Use mTLS for service-to-service communication, zero-trust networks, and machine-to-machine APIs where client identity must be verified.

How do I create trusted certificates for local development?▼

Use mkcert, which installs a local CA into your system trust store and generates certificates trusted by browsers automatically. Run mkcert -install once, then mkcert example.com localhost 127.0.0.1 to create the certificate and key files.

Why does my TLS connection fail with hostname mismatch errors?▼

The certificate's Subject Alternative Names do not include the hostname you are requesting. Regenerate the certificate with the correct DNS names and IP addresses in the SAN extension, since modern clients ignore the Common Name field.

How do I monitor certificate expiration in production?▼

Use Prometheus blackbox_exporter with the probe_ssl_earliest_cert_expiry metric and alert when expiry is under 7 days. For manual checks, run openssl x509 -noout -enddate or the included check-cert-expiry.sh script against files or remote hosts.

Should I use cert-manager, Certbot, or Vault PKI for certificate automation?▼

Use cert-manager for Kubernetes workloads, Certbot for traditional VMs with public Let's Encrypt certificates, and Vault PKI for dynamic short-lived certificates in microservices. The choice depends on your platform and whether you need internal CA support.

Related Skills

Explore More Software Engineering Skills→
arbazkhan971arbazkhan971
26

network

Automate DNS, SSL/TLS, CDN, and load balancer configuration and health validation.

Community
Intermediate
julianobarbosajulianobarbosa
7

keyvault-csi-driver

Mount Azure Key Vault secrets into Kubernetes pods via SecretProviderClass.

Community
Advanced
ancolemanancoleman
503

managing-secrets

Manage API keys, database credentials, and certificates with HashiCorp Vault.

Community
Advanced
wesleyegbertowesleyegberto
3

mtls-configuration

Configure mutual TLS in Istio, Linkerd, and SPIFFE service meshes.

Community
Advanced