# TLS Setup (/sdks/csharp/how-to/tls/tls-setup)



## Overview [#overview]

**Server-side TLS** is the baseline transport security for any KubeMQ connection that leaves a trusted network — it encrypts the wire and lets the client confirm it's really talking to your KubeMQ server, not an impersonator. Reach for it whenever traffic crosses a public network or a boundary you don't fully control; skip it and channel names, payloads, and client IDs travel in plaintext with no protection against a spoofed endpoint.

It works by pairing the client with the CA certificate that signed the server's TLS certificate: `TlsOptions` with `Enabled = true` and a `CaFile` path loads that CA file, and the client performs a standard TLS handshake, validating the server's certificate chain before any request is sent. The client presents no certificate of its own — only the server proves its identity.

**Gotchas:** this is one-way trust — it stops eavesdropping and server impersonation, but the server still can't verify who the *client* is (that's what [mTLS](/sdks/csharp/how-to/tls/mtls-setup) adds). `CaFile` must point to the issuing CA (or full chain), not the server's leaf certificate, or the handshake fails outright. And an expired or hostname-mismatched server certificate surfaces on `ConnectAsync()` the same way a missing CA path does — inspect the thrown exception's message before assuming your CA file is wrong.

## Prerequisites [#prerequisites]

* KubeMQ server running with TLS enabled
* C# SDK installed (`dotnet add package KubeMQ.Sdk`)
* TLS certificates (CA certificate file)

## Code [#code]

```csharp title="Program.cs"
// KubeMQ .NET SDK — Config: TLS Setup
//
// This example demonstrates connecting to a KubeMQ server with TLS encryption.
// The server must be configured with TLS certificates.
//
// Prerequisites:
//   - KubeMQ server running with TLS enabled
//   - CA certificate file available
//   - dotnet run

using KubeMQ.Sdk.Client;
using KubeMQ.Sdk.Config;

// TLS with CA certificate verification
await using var client = new KubeMQClient(new KubeMQClientOptions
{
    Address = "kubemq-server:50000",
    Tls = new TlsOptions
    {
        Enabled = true,
        CaFile = "/path/to/ca.pem"
    }
});

try
{
    await client.ConnectAsync();
    Console.WriteLine("Connected with TLS encryption");

    var info = await client.PingAsync();
    Console.WriteLine($"Server: {info}");
}
catch (Exception ex)
{
    Console.WriteLine($"Connection failed: {ex.Message}");
    Console.WriteLine("Ensure the server has TLS enabled and the CA certificate is valid.");
}

Console.WriteLine("Done.");
```

## How It Works [#how-it-works]

* `TlsOptions` with `Enabled = true` and a `CaFile` path activates server-side TLS verification.
* The client verifies the server's certificate against the provided CA certificate before establishing the connection.
* The `await using` pattern ensures the client is properly disposed after use.
* Replace `"/path/to/ca.pem"` with the actual path to your CA certificate.

## Related [#related]

* [C# SDK Reference](/sdks/csharp/reference)
* [mTLS Setup](/sdks/csharp/how-to/tls/mtls-setup)