How do I install the API Mtls Client Certificates skill?

Run npx skillmds@latest add deangrant/api-mtls-client-certificates in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is API Mtls Client Certificates safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with API Mtls Client Certificates?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is API Mtls Client Certificates free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published API Mtls Client Certificates?

deangrant (@deangrant) published this skill. Their other Agent Skills are listed on their SkillMD profile.

API Mtls Client Certificates

Name: API Mtls Client Certificates
Author: deangrant

Design mTLS and client-certificate authentication for APIs, including PKI rotation, cert-bound tokens (RFC 8705), and proxy header pitfalls. Use when securing service-to-service or partner edge access.

deangrant fe3809b 4 files · 1.7 KB Updated Sep 17, 2026

Integrations & APIs

Install

Press C to copy

$ npx skillmds@latest add deangrant/api-mtls-client-certificates

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download .zip

＋ Add to collection

README badge

[![SkillMD](https://skillmd.com/badge/deangrant/api-mtls-client-certificates.svg)](https://skillmd.com/skills/deangrant/api-mtls-client-certificates)

Trust & safety

Audits pending

Not yet audited · commit fe3809b

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

mTLS and Client Certificates

Use this skill for certificate-based client authentication.

1. Pattern

TLS handshake authenticates both sides. Validate full chain and revocation. Use short-lived certs with automated rotation.

2. Edge / gateway

Terminate mTLS at gateway for partners; forward verified cert attributes only via trusted internal headers (never trust client-supplied spoofable headers at the edge).

Consider RFC 8705 certificate-bound access tokens for OAuth + mTLS.

3. Quick checklist

Chain + revocation checks.
Automated rotation; truststore updates.
No spoofable cert headers from the public internet.
Document identity mapping (CN/SAN → principal).

See reference.md and examples.md.

deangrant/agents/tree/main/.agents/skills/api-mtls-client-certificates commit fe3809bdae

Frequently asked questions

npx skillmds@latest add deangrant/api-mtls-client-certificates