# Implementing Mtls For Zero Trust Services

> 使用 Python cryptography 库进行证书生成，使用 ssl 模块进行 TLS 验证， 配置微服务之间的双向 TLS（mTLS）身份验证。验证证书链、检查过期情况， 并审计 mTLS 部署状态。适用于实现零信任服务间身份验证的场景。

- Skill: `killvxk/implementing-mtls-for-zero-trust-services` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add killvxk/implementing-mtls-for-zero-trust-services`
- Raw SKILL.md: https://api.skillmd.com/api/skills/killvxk/implementing-mtls-for-zero-trust-services/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: killvxk (https://skillmd.com/u/killvxk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/killvxk/implementing-mtls-for-zero-trust-services

---


# 为零信任服务实现 mTLS

## 说明

生成 CA 证书、颁发服务证书，并配置用于服务间身份验证的双向 TLS 验证。

```python
from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
import datetime

# 生成 CA 密钥和证书
ca_key = rsa.generate_private_key(public_exponent=65537, key_size=4096)
ca_cert = (x509.CertificateBuilder()
    .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "Internal CA")]))
    .issuer_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "Internal CA")]))
    .public_key(ca_key.public_key())
    .serial_number(x509.random_serial_number())
    .not_valid_before(datetime.datetime.utcnow())
    .not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=3650))
    .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
    .sign(ca_key, hashes.SHA256()))
```

## 示例

```python
import ssl
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context.load_cert_chain("client.pem", "client-key.pem")
context.load_verify_locations("ca.pem")
context.verify_mode = ssl.CERT_REQUIRED
```