TLS Setup

Overview

Server-side TLS is the baseline transport security for any KubeMQ connection that leaves a trusted network — it encrypts the wire and lets the client confirm it's really talking to your KubeMQ server, not an impersonator. Reach for it whenever traffic crosses a public network or a boundary you don't fully control; skip it and channel names, payloads, and client IDs travel in plaintext with no protection against a spoofed endpoint.

It works by pairing the client with the CA certificate that signed the server's TLS certificate: TlsOptions with Enabled = true and a CaFile path loads that CA file, and the client performs a standard TLS handshake, validating the server's certificate chain before any request is sent. The client presents no certificate of its own — only the server proves its identity.

Gotchas: this is one-way trust — it stops eavesdropping and server impersonation, but the server still can't verify who the client is (that's what mTLS adds). CaFile must point to the issuing CA (or full chain), not the server's leaf certificate, or the handshake fails outright. And an expired or hostname-mismatched server certificate surfaces on ConnectAsync() the same way a missing CA path does — inspect the thrown exception's message before assuming your CA file is wrong.

Prerequisites

• KubeMQ server running with TLS enabled
• C# SDK installed (dotnet add package KubeMQ.Sdk)
• TLS certificates (CA certificate file)

Code

// KubeMQ .NET SDK — Config: TLS Setup
//
// This example demonstrates connecting to a KubeMQ server with TLS encryption.
// The server must be configured with TLS certificates.
//
// Prerequisites:
//   - KubeMQ server running with TLS enabled
//   - CA certificate file available
//   - dotnet run

using KubeMQ.Sdk.Client;
using KubeMQ.Sdk.Config;

// TLS with CA certificate verification
await using var client = new KubeMQClient(new KubeMQClientOptions
{
    Address = "kubemq-server:50000",
    Tls = new TlsOptions
    {
        Enabled = true,
        CaFile = "/path/to/ca.pem"
    }
});

try
{
    await client.ConnectAsync();
    Console.WriteLine("Connected with TLS encryption");

    var info = await client.PingAsync();
    Console.WriteLine($"Server: {info}");
}
catch (Exception ex)
{
    Console.WriteLine($"Connection failed: {ex.Message}");
    Console.WriteLine("Ensure the server has TLS enabled and the CA certificate is valid.");
}

Console.WriteLine("Done.");

How It Works

• TlsOptions with Enabled = true and a CaFile path activates server-side TLS verification.
• The client verifies the server's certificate against the provided CA certificate before establishing the connection.
• The await using pattern ensures the client is properly disposed after use.
• Replace "/path/to/ca.pem" with the actual path to your CA certificate.

Related

• C# SDK Reference
• mTLS Setup