Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Configuring TLS 1.3 for Secure Communications · mukul975 | DecimalAI

Configuring TLS 1 3 For Secure Communications

SkillScore4Maintained

configuring-tls-1-3-for-secure-communications

TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security protocol, providing significant improvements over TLS 1.2 in both security and performance. It reduces handshake latency to 1-R

DevOpsby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/configuring-tls-1-3-for-secure-communications/SKILL.md

decimalai skills pull configuring-tls-1-3-for-secure-communications --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/configuring-tls-1-3-for-secure-communications/SKILL.md https://app.decimal.ai/s/configuring-tls-1-3-for-secure-communications/SKILL.md

Raw file: /s/configuring-tls-1-3-for-secure-communications/SKILL.md ↗ · machine-readable summary at /s/configuring-tls-1-3-for-secure-communications.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +4% lift · at higher cost+48% tokens0% turns4% of whole cases pass with skill (1/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-14	✗→✓	▲ Improved	—	—
case-03	✗→✗	＝ Same ✗	—	—
case-02	✗→✗	＝ Same ✗	—	—
case-05	✗→✗	＝ Same ✗	—	—
case-12	✗→✗	＝ Same ✗	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/configuring-tls-1-3-for-secure-communications/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Configuring TLS 1.3 for Secure Communications

Overview

TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security protocol, providing significant improvements over TLS 1.2 in both security and performance. It reduces handshake latency to 1-RTT (and 0-RTT for resumed sessions), removes obsolete cipher suites, and mandates perfect forward secrecy. This skill covers configuring TLS 1.3 on servers, validating configurations, and testing for common misconfigurations.

When to Use

When deploying or configuring configuring tls 1 3 for secure communications capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Configure TLS 1.3 on nginx and Apache web servers
Implement TLS 1.3 in Python applications using the ssl module
Validate TLS configurations with openssl and testssl.sh
Understand TLS 1.3 cipher suites and key exchange mechanisms
Configure 0-RTT early data with appropriate protections
Disable legacy TLS versions (1.0, 1.1) and weak cipher suites

Key Concepts

TLS 1.3 Cipher Suites

| Cipher Suite | Key Exchange | Authentication | Encryption | Hash | |-------------|-------------|----------------|------------|------| | TLS_AES_256_GCM_SHA384 | ECDHE/DHE | Certificate | AES-256-GCM | SHA-384 | | TLS_AES_128_GCM_SHA256 | ECDHE/DHE | Certificate | AES-128-GCM | SHA-256 | | TLS_CHACHA20_POLY1305_SHA256 | ECDHE/DHE | Certificate | ChaCha20-Poly1305 | SHA-256 |

TLS 1.3 vs 1.2 Improvements

1-RTT Handshake: Full handshake completes in one round trip (vs 2 in TLS 1.2)
0-RTT Resumption: Resumed connections can send data immediately
No RSA Key Exchange: Only ephemeral Diffie-Hellman (mandatory PFS)
Simplified Cipher Suites: Removed CBC, RC4, 3DES, static RSA, SHA-1
Encrypted Handshake: Server certificate is encrypted after ServerHello

Key Exchange Groups

x25519: Curve25519 ECDH (preferred, fast)
secp256r1: NIST P-256 ECDH (widely supported)
secp384r1: NIST P-384 ECDH (higher security margin)
x448: Curve448 ECDH (highest security)

Workflow

Verify OpenSSL version supports TLS 1.3 (1.1.1+)
Generate or obtain TLS certificate and private key
Configure server to use TLS 1.3 cipher suites
Disable TLS 1.0 and 1.1 (optionally keep 1.2 for compatibility)
Set preferred key exchange groups
Enable OCSP stapling for certificate validation
Test configuration with openssl s_client and testssl.sh
Configure HSTS header for HTTP Strict Transport Security

Security Considerations

0-RTT data is vulnerable to replay attacks; limit to idempotent requests
Always include TLS 1.2 fallback if legacy client support is required
Use ECDSA certificates for better performance (vs RSA)
Enable OCSP stapling to improve client certificate validation
Set HSTS header with long max-age and includeSubDomains
Monitor for certificate transparency logs

Validation Criteria

] TLS 1.3 handshake completes successfully
] Only approved cipher suites are offered
] Perfect forward secrecy is enforced
] TLS 1.0 and 1.1 are rejected
] OCSP stapling is functional
] Certificate chain is valid and complete
] testssl.sh reports no vulnerabilities

Illustrative Want to see what configuring-tls-1-3-for-secure-communications would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 01:02 UTC · 23 cases

Lift

+4%

4% vs 0%

Agent turns

0%

1.0 vs 1.0

Tokens

+48%

1,948.04 vs 1,318.96

fail → pass · 1fail → fail · 22

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-03 A network architect is presenting a migration plan to switch network traffic from TLS 1.2 to TLS 1.3. A team member asks how many network round-trips (RTT) are required for a brand-new connection full handshake in TLS 1.3 compared to TLS 1.2's standard two round-trips. What RTT value should the architect state for TLS 1.3?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 An application operator wants to support high-performance encryption on ARM mobile devices without AES hardware acceleration over TLS 1.3. Which standard TLS 1.3 cipher suite based on ChaCha20 should be enabled?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 A backend developer wants to enable 0-RTT early data on an API gateway handling payment transactions submitted via HTTP POST. What security risk does enabling 0-RTT early data introduce for non-idempotent HTTP requests, and what restriction must be applied?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 A web security consultant is recommending HTTP security headers to pair with a new TLS 1.3 deployment to prevent downgrade attacks and enforce HTTPS across subdomains. What header and directives should be configured?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 A network engineer is configuring an IPsec IKEv2 site-to-site VPN tunnel in strongSwan (`ipsec.conf`). They want to set the ESP encryption proposal using TLS 1.3 cipher suite notation `TLS_AES_256_GCM_SHA384`. How should ESP proposals be configured in strongSwan?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 A DevOps engineer is evaluating session resumption latency for recurring client connections in TLS 1.3. What round-trip time (RTT) latency can resumed sessions achieve using early data?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 A system administrator needs to harden an OpenSSH server (`/etc/ssh/sshd_config`) by restricting SSH host keys and ciphers. Should they apply TLS 1.3 cipher suites like `TLS_AES_256_GCM_SHA384` to the `Ciphers` directive in `sshd_config`?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 An engineer is updating an Nginx web server configuration from TLS 1.2 to TLS 1.3. For TLS 1.2, they defined static RSA key exchange in `ssl_ciphers` using `ECDHE-RSA-AES256-GCM-SHA384`. They want to configure standard TLS 1.3 256-bit AES GCM cipher suite. How should this cipher suite be formatted in the configuration?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 A security engineer is configuring certificate validation enhancements on an Nginx TLS 1.3 web server. What feature allows the server to query the CA for revocation status and send a signed time-stamped OCSP response directly to the client during the handshake?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 A DevOps administrator is setting up a WireGuard VPN tunnel on Linux. They want to configure TLS 1.3 certificates and negotiate key exchange groups using `x25519` inside the WireGuard interface configuration file (`wg0.conf`). How does WireGuard handle key exchange and certificates?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 A sysadmin is updating an Apache HTTP Server (`httpd.conf`) configuration. They want to set the `SSLProtocol` directive to enable TLS 1.2 and TLS 1.3 while explicitly disabling older protocols. What exact `SSLProtocol` string should be configured?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 An administrator wants to configure the standard 128-bit AES GCM cipher suite for TLS 1.3. What is the standard RFC identifier for this cipher suite?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 A system administrator is selecting key exchange curves for TLS 1.3 on a Linux web server. They want the fastest and most efficient ECDH curve as the primary choice before fallback to NIST curves. Which group should be placed first?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 A security analyst examining packet captures notices that in TLS 1.2 the server certificate was sent in plaintext during the handshake, whereas in TLS 1.3 it cannot be seen in cleartext. At what point in the TLS 1.3 handshake is the server certificate sent?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 A security architect is selecting certificate keys for a high-traffic web service running TLS 1.3. They are choosing between traditional RSA 2048/4048 keys and ECDSA keys for maximum server handshake throughput. Which key type should be recommended and why?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 A security auditor is validating legacy cipher removal. List two weak symmetric cipher modes or algorithms present in TLS 1.2 that were completely eliminated in TLS 1.3.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 A systems engineer needs to build OpenSSL from source on a legacy Linux system to support TLS 1.3. What is the minimum version of OpenSSL required for native TLS 1.3 support?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 A government agency compliance policy requires choosing a NIST key exchange group offering a higher security margin than NIST P-256 for TLS 1.3 key exchange. Which key exchange group parameter corresponds to NIST P-384?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 An auditor is checking web server configuration compliance against modern security baselines. Which legacy TLS protocol versions must be completely disabled when enforcing TLS 1.3 security standards?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 A developer wants to configure static RSA key exchange in TLS 1.3 to allow passive network decryption via static server private keys, similar to older TLS 1.2 setups. How does TLS 1.3 handle static RSA key exchange?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 A Python software engineer is writing a script using Python's standard `ssl` module to create an SSLContext that enforces TLS 1.3 exclusively. How should `ssl_version` or protocol/minimum version flags be set on the context object?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 A system administrator wants to test if a remote server `example.com:443` supports TLS 1.3 from the command line using standard OpenSSL tools. What specific OpenSSL command and flag should be used to force a TLS 1.3 connection test?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 A security analyst needs to run an automated, comprehensive command-line tool to scan an HTTPS server for TLS 1.3 ciphers, protocol support, and vulnerabilities. What popular open-source bash script utility designed for testing TLS/SSL encryption can be used for this audit?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +4 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 4.4%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 01:02 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run4

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.