<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-secure-communication-channels
description: >-
  Design and implement secure communication channels using mTLS, WireGuard,
  SSH tunneling, and encrypted DNS. Covers mutual authentication, channel
  binding, perfect forward secrecy, and transport configuration for
  service-to-service and user-to-service communication.
domain: cybersecurity
subdomain: cryptography
tags:
  - mtls
  - wireguard
  - ssh-tunnel
  - encrypted-dns
  - transport-security
  - forward-secrecy
  - channel-binding
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1573"]
---

# Implementing Secure Communication Channels

## Overview

Secure communication channels protect data in transit through encryption,
authentication, and integrity verification. This skill covers mutual TLS for
zero-trust service communication, WireGuard VPN for network-level encryption,
SSH tunneling for secure port forwarding, and encrypted DNS.

## Prerequisites

| Requirement | Install |
|---|---|
| OpenSSL 3.x | `apt install openssl` |
| WireGuard | `apt install wireguard` |
| nmap | `apt install nmap` |
| curl | HTTP/TLS testing |

## Key Concepts

### Mutual TLS (mTLS)

```bash
# Generate CA for mTLS
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 \
  -keyout ca-key.pem -out ca-cert.pem -days 3650 -nodes \
  -subj "/CN=Internal mTLS CA"

# Generate server certificate
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 \
  -keyout server-key.pem -out server.csr -nodes \
  -subj "/CN=api.internal"
openssl x509 -req -in server.csr -CA ca-cert.pem -CAkey ca-key.pem \
  -CAcreateserial -out server-cert.pem -days 365

# Generate client certificate
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 \
  -keyout client-key.pem -out client.csr -nodes \
  -subj "/CN=service-worker"
openssl x509 -req -in client.csr -CA ca-cert.pem -CAkey ca-key.pem \
  -CAcreateserial -out client-cert.pem -days 365

# Test mTLS connection
curl --cert client-cert.pem --key client-key.pem \
  --cacert ca-cert.pem https://api.internal:8443/health
```

### WireGuard VPN

```bash
# Generate key pairs
wg genkey | tee server-private.key | wg pubkey > server-public.key
wg genkey | tee client-private.key | wg pubkey > client-public.key
wg genpsk > preshared.key

# Check WireGuard status
wg show wg0
```

### SSH Tunneling

```bash
# Local port forwarding
ssh -L 8080:internal-db:5432 -N jump-host

# Remote port forwarding
ssh -R 9090:localhost:8080 -N remote-server

# Dynamic SOCKS proxy
ssh -D 1080 -N -f jump-host
```

### TLS Configuration Hardening

```bash
# Enumerate cipher suites
nmap --script ssl-enum-ciphers -p 443 target.example.com

# Verify forward secrecy
openssl s_client -connect target:443 < /dev/null 2>/dev/null | \
  grep "Server Temp Key"
```

## Common Failures

| Failure | Cause | Fix |
|---|---|---|
| mTLS cert CN mismatch | Wrong client identity | Use SAN and verify against allow-list |
| WireGuard AllowedIPs too broad | Routes all traffic | Restrict to required subnets |
| SSH tunnel drops | No keepalive | `ServerAliveInterval 60` |
| TLS 1.0/1.1 enabled | Legacy config | Disable TLS < 1.2 |

## Workflow

1. **Design** — Select transport security for the use case
2. **Generate** — Create certificates, keys, configuration
3. **Deploy** — Configure server and client endpoints
4. **Test** — Verify encryption and authentication
5. **Harden** — Disable weak ciphers, enforce TLS 1.2+
6. **Monitor** — Continuous certificate and config monitoring

## Verification

| Check | Method |
|---|---|
| mTLS working | Client cert required and verified |
| Forward secrecy | ECDHE key exchange in use |
| Strong ciphers only | No NULL, RC4, DES, EXPORT |
| WireGuard active | `wg show` confirms handshake |

## References

- [WireGuard Documentation](https://www.wireguard.com/)
- [NIST SP 800-52 Rev. 2](https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final)
- [Mozilla TLS Config Generator](https://ssl-config.mozilla.org/)
- [OpenSSL s_client Manual](https://www.openssl.org/docs/man3.0/man1/openssl-s_client.html)
