TLS Setup

Overview

Server-side TLS is the baseline transport security for any KubeMQ connection that leaves a trusted network — it encrypts the wire and lets the client confirm it's really talking to your KubeMQ server, not an impersonator. Reach for it whenever traffic crosses a public network or a boundary you don't fully control; skip it and channel names, payloads, and client IDs travel in plaintext with no protection against a spoofed endpoint.

It works by pairing the client with the CA certificate that signed the server's TLS certificate: kubemq.WithTLS() loads that CA file and the gRPC connection performs a standard TLS handshake, validating the server's certificate chain before any request is sent. The client presents no certificate of its own — only the server proves its identity.

Gotchas: this is one-way trust — it stops eavesdropping and server impersonation, but the server still can't verify who the client is (that's what mTLS adds). The CA file must be the issuing CA (or full chain), not the server's leaf certificate, or the handshake fails outright. And an expired or hostname-mismatched server certificate fails the same way as a missing CA path — read the returned error before assuming your CA file is the problem.

Prerequisites

• KubeMQ server running with TLS enabled
• Go SDK installed (go get github.com/kubemq-io/kubemq-go/v2)
• TLS certificates (CA certificate file)

Code

// Example: tls/tls-setup
//
// Demonstrates how to connect to a KubeMQ server using server-side TLS.
// The client verifies the server's certificate using a CA certificate file.
//
// Channel: go-tls.tls-setup
// Client ID: go-tls-tls-setup-client
//
// Run with a KubeMQ server configured with TLS.
package main

import (
	"context"
	"fmt"
	"log"
	"time"

	"github.com/kubemq-io/kubemq-go/v2"
)

func main() {
	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()

	// Connect with server-side TLS using a CA certificate file.
	// Replace "path/to/ca-cert.pem" with the actual path to your CA certificate.
	client, err := kubemq.NewClient(ctx,
		kubemq.WithAddress("kubemq.example.com", 50000),
		kubemq.WithClientId("go-tls-tls-setup-client"),
		kubemq.WithTLS("path/to/ca-cert.pem"),
	)
	if err != nil {
		log.Fatalf("TLS connection failed: %v", err)
	}
	defer client.Close()

	// Verify the secure connection.
	info, err := client.Ping(ctx)
	if err != nil {
		log.Fatalf("Ping failed: %v", err)
	}
	fmt.Printf("TLS connected: host=%s version=%s\n", info.Host, info.Version)
}

How It Works

• kubemq.WithTLS() accepts a path to the CA certificate file used to verify the server's identity.
• The client establishes a gRPC connection over TLS, encrypting all traffic between client and server.
• A Ping call confirms the secure connection is working correctly.
• The CA certificate path is a placeholder — it must point to the actual CA certificate file before the example connects successfully.

Related

• Go SDK Reference
• mTLS Setup