What it does. Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-tls-1-3-for-secure-communications, or copy the skill folder into ~/.claude/skills/configuring-tls-1-3-for-secure-communications/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-tls-1-3-for-secure-communications/SKILL.md
SKILL.md (verbatim)
name: configuring-tls-1-3-for-secure-communications
description: Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and
key-exchange group selection, and validates the resulting configuration with openssl
s_client and testssl.sh. Use when deploying or hardening TLS 1.3 for secure communications,
or when testing a server for common TLS misconfigurations and vulnerabilities.
domain: cybersecurity
subdomain: cryptography
tags:
- cryptography
- tls
- ssl
- transport-security
- network-security
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.DS-01
- PR.DS-02
- PR.DS-10
mitre_attack:
- T1557
- T1040
- T1573.002
- T1539
- T1556.004
Configuring TLS 1.3 for Secure Communications
Overview
TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security protocol, providing significant improvements over TLS 1.2 in both security and performance. It reduces handshake latency to 1-RTT (and 0-RTT for resumed sessions), removes obsolete cipher suites, and mandates perfect forward secrecy. This skill covers configuring TLS 1.3 on servers, validating configurations, and testing for common misconfigurations.
When to Use
- When deploying or configuring configuring tls 1 3 for secure communications capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Familiarity with cryptography concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Configure TLS 1.3 on nginx and Apache web servers
- Implement TLS 1.3 in Python applications using the ssl module
- Validate TLS configurations with openssl and testssl.sh
- Understand TLS 1.3 cipher suites and key exchange mechanisms
- Configure 0-RTT early data with appropriate protections
- Disable legacy TLS versions (1.0, 1.1) and weak cipher suites
Key Concepts
TLS 1.3 Cipher Suites
| Cipher Suite |
Key Exchange |
Authentication |
Encryption |
Hash |
| TLS_AES_256_GCM_SHA384 |
ECDHE/DHE |
Certificate |
AES-256-GCM |
SHA-384 |
| TLS_AES_128_GCM_SHA256 |
ECDHE/DHE |
Certificate |
AES-128-GCM |
SHA-256 |
| TLS_CHACHA20_POLY1305_SHA256 |
ECDHE/DHE |
Certificate |
ChaCha20-Poly1305 |
SHA-256 |
TLS 1.3 vs 1.2 Improvements
- 1-RTT Handshake: Full handshake completes in one round trip (vs 2 in TLS 1.2)
- 0-RTT Resumption: Resumed connections can send data immediately
- No RSA Key Exchange: Only ephemeral Diffie-Hellman (mandatory PFS)
- Simplified Cipher Suites: Removed CBC, RC4, 3DES, static RSA, SHA-1
- Encrypted Handshake: Server certificate is encrypted after ServerHello
Key Exchange Groups
- x25519: Curve25519 ECDH (preferred, fast)
- secp256r1: NIST P-256 ECDH (widely supported)
- secp384r1: NIST P-384 ECDH (higher security margin)
- x448: Curve448 ECDH (highest security)
Workflow
- Verify OpenSSL version supports TLS 1.3 (1.1.1+)
- Generate or obtain TLS certificate and private key
- Configure server to use TLS 1.3 cipher suites
- Disable TLS 1.0 and 1.1 (optionally keep 1.2 for compatibility)
- Set preferred key exchange groups
- Enable OCSP stapling for certificate validation
- Test configuration with openssl s_client and testssl.sh
- Configure HSTS header for HTTP Strict Transport Security
Security Considerations
- 0-RTT data is vulnerable to replay attacks; limit to idempotent requests
- Always include TLS 1.2 fallback if legacy client support is required
- Use ECDSA certificates for better performance (vs RSA)
- Enable OCSP stapling to improve client certificate validation
- Set HSTS header with long max-age and includeSubDomains
- Monitor for certificate transparency logs
Validation Criteria
Other files in this skill
assets/template.md (verbatim)
TLS 1.3 Configuration Template
Pre-Configuration Checklist
nginx Configuration Template
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers off;
ssl_ecdh_curve X25519:secp256r1:secp384r1;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
Python TLS 1.3 Client Template
import ssl
import socket
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context.minimum_version = ssl.TLSVersion.TLSv1_3
context.load_default_certs()
with socket.create_connection(("example.com", 443)) as sock:
with context.wrap_socket(sock, server_hostname="example.com") as tls:
print(f"Protocol: {tls.version()}")
print(f"Cipher: {tls.cipher()}")
Validation Commands
# Test TLS 1.3 support
openssl s_client -connect example.com:443 -tls1_3
# Show full certificate chain
openssl s_client -connect example.com:443 -showcerts
# List supported cipher suites
openssl s_client -connect example.com:443 -cipher 'ALL' -tls1_3
# Test with testssl.sh
./testssl.sh --protocols --ciphers --headers example.com
| Header |
Value |
Purpose |
| Strict-Transport-Security |
max-age=63072000; includeSubDomains; preload |
Force HTTPS |
| X-Content-Type-Options |
nosniff |
Prevent MIME sniffing |
| X-Frame-Options |
DENY |
Prevent clickjacking |
| Content-Security-Policy |
default-src 'self' |
Prevent XSS |
| Referrer-Policy |
strict-origin-when-cross-origin |
Limit referrer leakage |
references/api-reference.md (verbatim)
TLS 1.3 Configuration — API Reference
Libraries
| Library |
Install |
Purpose |
| cryptography |
pip install cryptography |
X.509 certificate parsing |
| ssl |
stdlib |
TLS connection testing |
| sslyze |
pip install sslyze |
Comprehensive TLS/SSL scanner |
Python ssl Module Methods
| Method |
Description |
ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) |
Create TLS client context |
ctx.minimum_version = ssl.TLSVersion.TLSv1_3 |
Set minimum TLS version |
ctx.wrap_socket(sock, server_hostname=) |
Wrap socket with TLS |
ssock.cipher() |
Get negotiated cipher tuple |
ssock.getpeercert(binary_form=True) |
Get server certificate DER bytes |
TLS 1.3 Cipher Suites
| Cipher Suite |
Security |
| TLS_AES_256_GCM_SHA384 |
Recommended |
| TLS_AES_128_GCM_SHA256 |
Recommended |
| TLS_CHACHA20_POLY1305_SHA256 |
Recommended (mobile) |
Deprecated Versions
| Version |
Status |
Risk |
| SSL 3.0 |
Deprecated (RFC 7568) |
POODLE attack |
| TLS 1.0 |
Deprecated (RFC 8996) |
BEAST, CRIME |
| TLS 1.1 |
Deprecated (RFC 8996) |
Weak ciphers |
External References
references/standards.md (verbatim)
Standards and References - TLS 1.3 Configuration
Primary Standards
RFC 8446 - The Transport Layer Security (TLS) Protocol Version 1.3
RFC 8447 - IANA Registry Updates for TLS and DTLS
RFC 8449 - Record Size Limit Extension for TLS
RFC 8470 - Using Early Data in HTTP (0-RTT)
RFC 6961 - TLS Multiple Certificate Status Extension (OCSP Stapling)
RFC 6797 - HTTP Strict Transport Security (HSTS)
NIST Guidelines
NIST SP 800-52 Rev. 2 - Guidelines for TLS Implementations
NIST SP 800-57 Part 3 Rev. 1 - Application-Specific Key Management
testssl.sh
SSL Labs Server Test
Mozilla SSL Configuration Generator
Compliance
PCI DSS v4.0
- TLS 1.0 and early TLS prohibited since June 2018
- TLS 1.2+ required; TLS 1.3 recommended
- Strong cipher suites must be configured
HIPAA
- Encryption in transit required for ePHI
- TLS 1.2+ satisfies the requirement
references/workflows.md (verbatim)
Workflows - Configuring TLS 1.3
Workflow 1: TLS 1.3 Handshake (1-RTT)
Client Server
| |
|--- ClientHello ------------------>|
| (supported_versions: TLS 1.3) |
| (key_share: x25519) |
| (signature_algorithms) |
| (cipher_suites) |
| |
|<-- ServerHello -------------------|
| (selected cipher suite) |
| (key_share: x25519) |
|<-- {EncryptedExtensions} ---------|
|<-- {Certificate} -----------------|
|<-- {CertificateVerify} -----------|
|<-- {Finished} --------------------|
| |
|--- {Finished} ------------------->|
| |
|<== Application Data ==============>|
Workflow 2: nginx TLS 1.3 Configuration
1. Check OpenSSL version (>= 1.1.1)
$ openssl version
2. Generate ECDSA certificate
$ openssl ecparam -genkey -name prime256v1 -out server.key
$ openssl req -new -x509 -key server.key -out server.crt -days 365
3. Configure nginx
Edit /etc/nginx/nginx.conf
4. Test configuration
$ nginx -t
5. Reload nginx
$ systemctl reload nginx
6. Verify TLS 1.3
$ openssl s_client -connect localhost:443 -tls1_3
Workflow 3: TLS Configuration Validation
[Server] --> [openssl s_client test]
|
[Check protocol version]
[Check cipher suite]
[Check certificate chain]
|
[testssl.sh full scan]
|
[Check for vulnerabilities]
- BEAST, POODLE, Heartbleed
- ROBOT, DROWN, FREAK
- Weak ciphers, expired certs
|
[SSL Labs grade assessment]
Target: A+ rating
Workflow 4: Certificate Lifecycle
[Generate Key Pair]
|
[Create CSR] --> [Submit to CA]
|
[CA Issues Certificate]
|
[Install Certificate]
|
[Configure OCSP Stapling]
|
[Set Up Auto-Renewal]
(certbot / ACME)
|
[Monitor Expiration]
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.