TLS Setup

Overview

Server-side TLS is the baseline transport security for any KubeMQ connection that leaves a trusted network — it encrypts the wire and lets the client confirm it's really talking to your KubeMQ broker, not an impersonator. Reach for it whenever traffic crosses a public network or a boundary you don't fully control; skip it and channel names, payloads, and client IDs travel in plaintext with no protection against a spoofed endpoint.

It works by pairing the client with the CA certificate that signed the broker's TLS certificate: TlsConfig { ca_cert_file: Some(...), .. } loads that CA file, and KubemqClient::builder().tls_config(tls) performs a standard TLS handshake, validating the broker's certificate chain before any request is sent. The client presents no certificate of its own — only the broker proves its identity.

Gotchas: this is one-way trust — it stops eavesdropping and broker impersonation, but the broker still can't verify who the client is (that's what mTLS adds). ca_cert_file must point to the issuing CA (or full chain), not the broker's leaf certificate, or the handshake fails outright. Certificate files are loaded with async I/O (tokio::fs::read), so a bad path or permissions error surfaces at connect time, not at config construction — build and connect the client before trusting that your TlsConfig is valid.

Prerequisites

• KubeMQ server running with TLS enabled
• CA certificate file available
• Rust SDK installed (cargo add kubemq)

Code

use kubemq::prelude::*;
use kubemq::TlsConfig;

#[tokio::main]
async fn main() -> kubemq::Result<()> {
    let tls = TlsConfig {
        ca_cert_file: Some("/path/to/ca.pem".to_string()),
        ..Default::default()
    };

    let client = KubemqClient::builder()
        .host("localhost")
        .port(50000)
        .tls_config(tls)
        .build()
        .await?;

    let info = client.ping().await?;
    println!("Connected with TLS. Server version: {}", info.version);

    client.close().await?;
    Ok(())
}

How It Works

• TlsConfig supports both file paths (ca_cert_file) and PEM bytes (ca_cert_pem).
• The SDK uses async file I/O (tokio::fs::read) for loading certificate files.
• TLS can also be configured via environment variables: KUBEMQ_TLS_CERT_FILE, KUBEMQ_TLS_CERT_DATA.
• Review timeouts, channel names, and client IDs before running against shared environments.
• Run the program while the server from the prerequisites is available.

Related

• Getting Started
• Rust SDK Reference
• mTLS Setup