diff --git a/server/client_test.go b/server/client_test.go
index ebbc036bc85..4587c18cb48 100644
--- a/server/client_test.go
+++ b/server/client_test.go
@@ -85,7 +85,7 @@ func createClientAsync(ch chan *client, s *Server, cli net.Conn) {
 		s.grWG.Add(1)
 	}
 	go func() {
-		c := s.createClient(cli)
+		c := s.createClient(cli, false)
 		// Must be here to suppress +OK
 		c.opts.Verbose = false
 		if startWriteLoop {
@@ -2270,7 +2270,7 @@ func TestCloseConnectionVeryEarly(t *testing.T) {
 			// Call again with this closed connection. Alternatively, we
 			// would have to call with a fake connection that implements
 			// net.Conn but returns an error on Write.
-			s.createClient(c)
+			s.createClient(c, false)
 
 			// This connection should not have been added to the server.
 			checkClientsCount(t, s, 0)
diff --git a/server/server.go b/server/server.go
index ec6239900a4..5caa6fed85b 100644
--- a/server/server.go
+++ b/server/server.go
@@ -2192,7 +2192,7 @@ func (s *Server) AcceptLoop(clr chan struct{}) {
 	s.clientConnectURLs = s.getClientConnectURLs()
 	s.listener = l
 
-	go s.acceptConnections(l, "Client", func(conn net.Conn) { s.createClient(conn) },
+	go s.acceptConnections(l, "Client", func(conn net.Conn) { s.createClient(conn, false) },
 		func(_ error) bool {
 			if s.isLameDuckMode() {
 				// Signal that we are not accepting new clients
@@ -2217,7 +2217,7 @@ func (s *Server) AcceptLoop(clr chan struct{}) {
 func (s *Server) InProcessConn() (net.Conn, error) {
 	pl, pr := net.Pipe()
 	if !s.startGoRoutine(func() {
-		s.createClient(pl)
+		s.createClient(pl, true)
 		s.grWG.Done()
 	}) {
 		pl.Close()
@@ -2571,7 +2571,7 @@ func (c *tlsMixConn) Read(b []byte) (int, error) {
 	return c.Conn.Read(b)
 }
 
-func (s *Server) createClient(conn net.Conn) *client {
+func (s *Server) createClient(conn net.Conn, inProcess bool) *client {
 	// Snapshot server options.
 	opts := s.getOpts()
 
@@ -2659,7 +2659,7 @@ func (s *Server) createClient(conn net.Conn) *client {
 	}
 	s.clients[c.cid] = c
 
-	tlsRequired := info.TLSRequired
+	tlsRequired := info.TLSRequired && !inProcess
 	s.mu.Unlock()
 
 	// Re-Grab lock