# TLS Setup (/sdks/go/how-to/tls/tls-setup)



## Overview [#overview]

**Server-side TLS** is the baseline transport security for any KubeMQ connection that leaves a trusted network — it encrypts the wire and lets the client confirm it's really talking to your KubeMQ server, not an impersonator. Reach for it whenever traffic crosses a public network or a boundary you don't fully control; skip it and channel names, payloads, and client IDs travel in plaintext with no protection against a spoofed endpoint.

It works by pairing the client with the CA certificate that signed the server's TLS certificate: `kubemq.WithTLS()` loads that CA file and the gRPC connection performs a standard TLS handshake, validating the server's certificate chain before any request is sent. The client presents no certificate of its own — only the server proves its identity.

**Gotchas:** this is one-way trust — it stops eavesdropping and server impersonation, but the server still can't verify who the *client* is (that's what [mTLS](/sdks/go/how-to/tls/mtls-setup) adds). The CA file must be the issuing CA (or full chain), not the server's leaf certificate, or the handshake fails outright. And an expired or hostname-mismatched server certificate fails the same way as a missing CA path — read the returned error before assuming your CA file is the problem.

## Prerequisites [#prerequisites]

* KubeMQ server running with TLS enabled
* Go SDK installed (`go get github.com/kubemq-io/kubemq-go/v2`)
* TLS certificates (CA certificate file)

## Code [#code]

```go title="main.go"
// Example: tls/tls-setup
//
// Demonstrates how to connect to a KubeMQ server using server-side TLS.
// The client verifies the server's certificate using a CA certificate file.
//
// Channel: go-tls.tls-setup
// Client ID: go-tls-tls-setup-client
//
// Run with a KubeMQ server configured with TLS.
package main

import (
	"context"
	"fmt"
	"log"
	"time"

	"github.com/kubemq-io/kubemq-go/v2"
)

func main() {
	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()

	// Connect with server-side TLS using a CA certificate file.
	// Replace "path/to/ca-cert.pem" with the actual path to your CA certificate.
	client, err := kubemq.NewClient(ctx,
		kubemq.WithAddress("kubemq.example.com", 50000),
		kubemq.WithClientId("go-tls-tls-setup-client"),
		kubemq.WithTLS("path/to/ca-cert.pem"),
	)
	if err != nil {
		log.Fatalf("TLS connection failed: %v", err)
	}
	defer client.Close()

	// Verify the secure connection.
	info, err := client.Ping(ctx)
	if err != nil {
		log.Fatalf("Ping failed: %v", err)
	}
	fmt.Printf("TLS connected: host=%s version=%s\n", info.Host, info.Version)
}
```

## How It Works [#how-it-works]

* `kubemq.WithTLS()` accepts a path to the CA certificate file used to verify the server's identity.
* The client establishes a gRPC connection over TLS, encrypting all traffic between client and server.
* A `Ping` call confirms the secure connection is working correctly.
* The CA certificate path is a placeholder — it must point to the actual CA certificate file before the example connects successfully.

## Related [#related]

* [Go SDK Reference](/sdks/go/reference)
* [mTLS Setup](/sdks/go/how-to/tls/mtls-setup)