protocol-securitylisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/protocol-security/SKILL.md. --> # Protocol Security Transport security where the client establishes trust: TLS version floor, certificate chain and hostname verification, the trust store, connecting by IP, mTLS and workload identity as authentication, gRPC channel credentials, and SMTP STARTTLS. Use when generating HTTP, gRPC, or SMTP clients and servers, configuring TLS in code or platform config, wiring service-to-service authentication, or when tempted to disable certificate verification. ## ALWAYS - Default to **TLS 1.3**, and permit TLS 1.2 only where a peer genuinely requires it. Disable TLS 1.0, 1.1, and every SSL version. Cipher-suite selection is a consequence of the version floor rather than a separate decision — `references/tls-configuration.md` carries the suite lists and the per-platform config keys. - Verify the full certificate chain on every connection: a trusted issuer, an unexpired validity window, and a hostname that matches a **`subjectAltName` dNSName** entry. The hostname is checked *against* the SAN — SAN is not an alternative place to look, and a `CN` match is not a fallback, because current browsers and TLS libraries removed CN as a hostname source. - When connecting to an **IP address** rather than a name, set the expected name explicitly (`ServerName` in Go's `tls.Config`, the e