tls-compliance
Installation
SKILL.md
TLS Compliance
Enforce strong TLS configuration across Kubernetes workloads to prevent protocol downgrade attacks, weak cipher exploitation, and certificate-related outages. For algorithm-level guidance (cipher selection, key sizes, post-quantum algorithms), see the algorithm-selection skill.
TLS Version Enforcement
Default to TLS 1.3 for all new services. TLS 1.3 is the strongest available protocol — it mandates forward secrecy, uses only AEAD ciphers, eliminates legacy cipher negotiation, reduces handshake latency, and is inherently post-quantum ready (no static RSA key exchange).
For legacy services that cannot yet support TLS 1.3, require TLS 1.2 as the minimum. Disable TLS 1.0 and 1.1 — both are deprecated by RFC 8996.
| Version | Status | Recommendation |
|---|---|---|
| TLS 1.3 | Current | Default for new services — PQC-ready, AEAD-only |
| TLS 1.2 | Acceptable | Minimum for legacy — AEAD cipher suites only |
| TLS 1.1 | Deprecated | Disable — RFC 8996 |
| TLS 1.0 | Deprecated | Disable — RFC 8996 |