# TLS and mTLS (/connectors/rabbitmq/how-to/tls-and-mtls)



The KubeMQ RabbitMQ connector exposes a TLS/AMQPS listener on port **5671**. TLS is **not**
AMQP-specific: it is governed by the server-global **`Security`** block, shared with the gRPC and
REST connectors. This guide documents server-auth TLS and mutual TLS (mTLS).

<Callout type="info">
  TLS is configured server-side from the top-level &#x2A;*`Security`** block (not from any AMQP-specific
  field). The runnable examples use plain `amqp://` against a stock dev broker; to use `amqps://`,
  supply your own certificates and configure the `Security` block — see
  [Configuration](/connectors/rabbitmq/concepts/configuration). For the shared TLS/security model across
  KubeMQ connectors, see [Auth & security](/connectors/reference/auth-and-security).
</Callout>

## When TLS is active [#when-tls-is-active]

The TLS listener (`TlsPort`, default `5671`) is active **only when the server-global `Security`
block is configured** (`Mode` ≠ None). When it is active:

* TLS &#x2A;*1.2+** is enforced;
* the URL form is `amqps://<user>:<JWT>@host:5671/<vhost>`;
* mTLS (client certificates) is supported.

The plain listener (`Port`, default `5672`) continues to work alongside the TLS listener.

```bash
export KUBEMQ_AMQP_URL="amqps://guest:guest@localhost:5671/"
```

<Callout type="warn">
  **Why TLS matters here.** The KubeMQ JWT travels in the SASL PLAIN password in **cleartext at the
  AMQP layer**. Without TLS the JWT is exposed on the wire. Production deployments that use
  authentication MUST use the 5671 TLS listener. See
  [Authentication](/connectors/rabbitmq/how-to/authentication).
</Callout>

## TLS (server authentication) [#tls-server-authentication]

The client validates the server certificate against a trusted CA, then performs the normal SASL
PLAIN handshake over the encrypted channel. The per-language idioms:

| Language             | TLS entry point                                                 |
| -------------------- | --------------------------------------------------------------- |
| Go                   | `amqp.DialTLS(url, tlsConfig)`                                  |
| Python (pika)        | `pika.SSLOptions(ssl_context)`                                  |
| Java                 | `factory.useSslProtocol(sslContext)`                            |
| JavaScript (amqplib) | TLS options passed to `connect(url, { ... })`                   |
| C# (.NET)            | `ConnectionFactory.Ssl = new SslOption { ... }`                 |
| Ruby (bunny)         | `Bunny.new("amqps://…", tls: true, tls_ca_certificates: [...])` |
| Rust (lapin)         | `rustls` / `native-tls` feature + TLS connection properties     |

A server-auth TLS connection still authenticates separately at the SASL layer (PLAIN with the JWT
in the password) — see [Authentication](/connectors/rabbitmq/how-to/authentication).

## mTLS (mutual authentication) [#mtls-mutual-authentication]

mTLS additionally presents a **client certificate** validated by the server's CA. Configure the
server-global `Security` block to require client certs, then supply the client cert / key / CA on
the connection:

```text
amqps://<user>:<JWT>@host:5671/<vhost>
  + client certificate (cert + private key)
  + CA bundle that signed the server certificate
  + verify_peer = true
```

## Configuration [#configuration]

TLS is configured via the server-global `Security` block, not the AMQP config. The only
AMQP-specific knob is the listener port:

| Env var                    | Default | Effect                                     |
| -------------------------- | ------- | ------------------------------------------ |
| `CONNECTORS_AMQP_TLS_PORT` | `5671`  | TLS/AMQPS listener port; `0` disables TLS. |

See [Configuration](/connectors/rabbitmq/concepts/configuration).

## Related [#related]

<Cards>
  <Card title="Authentication" href="/connectors/rabbitmq/how-to/authentication" description="SASL PLAIN with the JWT in the password — the credential this TLS listener exists to protect." />

  <Card title="Configuration" href="/connectors/rabbitmq/concepts/configuration" description="The Security block, CONNECTORS_AMQP_TLS_PORT, and the rest of the connector's server-side settings." />

  <Card title="Auth & security" href="/connectors/reference/auth-and-security" description="The shared TLS/mTLS and JWT security model across KubeMQ connectors." />
</Cards>