# TLS Setup (/sdks/rust/how-to/tls/tls-setup)



## Overview [#overview]

**Server-side TLS** is the baseline transport security for any KubeMQ connection that leaves a trusted network — it encrypts the wire and lets the client confirm it's really talking to your KubeMQ broker, not an impersonator. Reach for it whenever traffic crosses a public network or a boundary you don't fully control; skip it and channel names, payloads, and client IDs travel in plaintext with no protection against a spoofed endpoint.

It works by pairing the client with the CA certificate that signed the broker's TLS certificate: `TlsConfig { ca_cert_file: Some(...), .. }` loads that CA file, and `KubemqClient::builder().tls_config(tls)` performs a standard TLS handshake, validating the broker's certificate chain before any request is sent. The client presents no certificate of its own — only the broker proves its identity.

**Gotchas:** this is one-way trust — it stops eavesdropping and broker impersonation, but the broker still can't verify who the *client* is (that's what [mTLS](/sdks/rust/how-to/tls/mtls-setup) adds). `ca_cert_file` must point to the issuing CA (or full chain), not the broker's leaf certificate, or the handshake fails outright. Certificate files are loaded with async I/O (`tokio::fs::read`), so a bad path or permissions error surfaces at connect time, not at config construction — build and connect the client before trusting that your `TlsConfig` is valid.

## Prerequisites [#prerequisites]

* KubeMQ server running with TLS enabled
* CA certificate file available
* Rust SDK installed (`cargo add kubemq`)

## Code [#code]

```rust title="main.rs"
use kubemq::prelude::*;
use kubemq::TlsConfig;

#[tokio::main]
async fn main() -> kubemq::Result<()> {
    let tls = TlsConfig {
        ca_cert_file: Some("/path/to/ca.pem".to_string()),
        ..Default::default()
    };

    let client = KubemqClient::builder()
        .host("localhost")
        .port(50000)
        .tls_config(tls)
        .build()
        .await?;

    let info = client.ping().await?;
    println!("Connected with TLS. Server version: {}", info.version);

    client.close().await?;
    Ok(())
}
```

## How It Works [#how-it-works]

* `TlsConfig` supports both file paths (`ca_cert_file`) and PEM bytes (`ca_cert_pem`).
* The SDK uses async file I/O (`tokio::fs::read`) for loading certificate files.
* TLS can also be configured via environment variables: `KUBEMQ_TLS_CERT_FILE`, `KUBEMQ_TLS_CERT_DATA`.
* Review timeouts, channel names, and client IDs before running against shared environments.
* Run the program while the server from the prerequisites is available.

## Related [#related]

* [Getting Started](/deploy)
* [Rust SDK Reference](/sdks/rust/reference/client)
* [mTLS Setup](/sdks/rust/how-to/tls/mtls-setup)