Configure Mutual TLS for Zero-Trust

A comprehensive implementation guide for mutual TLS (mTLS) in zero-trust service-mesh communication. Covers the mTLS handshake flow through sidecar proxies and a certificate hierarchy (root CA to intermediate CA to per-workload certs), with ready-to-use templates for Istio (PeerAuthentication in STRICT/PERMISSIVE mode, port-level mTLS overrides, DestinationRule for mesh-internal and external-service TLS), cert-manager (ClusterIssuer and Certificate resources for automated issuance), SPIFFE/SPIRE (server and agent configuration for workload identity), and Linkerd (automatic mTLS, per-port TLS skipping). It also documents certificate-rotation and debugging commands and a do's/don'ts list - start PERMISSIVE and migrate to STRICT, use short-lived (24h or less) certs, monitor expiry, never disable mTLS or use self-signed certs in production. The cert-manager template issues short-lived workload certs with an explicit 24-hour duration and an 8-hour renew-before window, tied to a ClusterIssuer backed by the Istio CA secret; the SPIRE server template sets a 168-hour CA TTL, a 1-hour default workload SVID TTL, and a Kubernetes PSAT node attestor scoped to an allow-listed service account. For external services without Linkerd's automatic mTLS, its Server resource can set proxyProtocol explicitly, and specific ports - the template calls out MySQL's 3306 - can be annotated with config.linkerd.io/skip-outbound-ports to skip TLS entirely.

### Istio - Check if mTLS is enabled
istioctl authn tls-check my-service.my-namespace.svc.cluster.local

Use it when implementing zero-trust networking, securing service-to-service communication, rotating or managing certificates, debugging TLS handshake failures, meeting compliance requirements (PCI-DSS, HIPAA), or securing multi-cluster communication.

Input: a service mesh (Istio, Linkerd) or workload-identity system (SPIFFE/SPIRE) needing mTLS configuration, or a TLS handshake issue to debug. Output: ready-to-apply YAML manifests (PeerAuthentication, DestinationRule, ClusterIssuer, Certificate, SPIRE server/agent config), plus rotation and debugging command sequences (istioctl proxy-config, istioctl authn tls-check, linkerd viz edges/tap), including fleet-wide policy audits via kubectl get peerauthentication --all-namespaces and kubectl get destinationrule --all-namespaces, and proxy log inspection with kubectl logs ... -c istio-proxy | grep -i tls.

Covers Istio, Linkerd, cert-manager, and SPIFFE/SPIRE as the concrete mesh, identity, and PKI systems, with further-reading pointers to the Istio Security docs, spiffe.io, cert-manager.io, and NIST's Zero Trust Architecture publication.

Platform and security engineers implementing or debugging mutual TLS across a service mesh, especially under compliance requirements like PCI-DSS or HIPAA.

Its do's/don'ts list separately calls out CA rotation as its own planned operation, distinct from routine workload-certificate rotation.