TLS handshake error: EOF

[edo888]

Hi,

I have configured nats with TLS, but clients fail to connect with "TLS handshake error: EOF" message. When I enable debug it says:

cid:10 - Starting TLS client connection handshake
cid:10 - TLS handshake error: EOF
cid:10 - Client connection closed: TLS Handshake Failure

It does not seem that TLS is active on the nats server, however monitoring is fine:

openssl s_client -tls1_2 -showcerts -connect 127.0.0.1:8222

outputs the certificate information

openssl s_client -tls1_2 -showcerts -connect 127.0.0.1:4222

outputs:

CONNECTED(00000003)
34371108864:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:/usr/src/crypto/openssl/ssl/record/ssl3_record.c:332:

no peer certificate available

I expect it to output the same certificate information as for monitoring.

It is the same when you try to connect to some server which has no TLS enabled like 1.1.1.1:80

telnet 127.0.0.1 4222

outputs regular text info which has "tls_required":true parameter set.

I'm using version 2.6.6.

Can you help?

Thanks!

[kozlovic]

The protocol between server and client is the server send first a plain text message, then it is upgraded to TLS. This is why if you telnet to the server you will see the INFO protocol come first. So you can't use openssl tool to directly connect to the NATS Server because those tool expects the TLS handshake to happen right away.

I think your issue is simply that the client fails the TLS handshake. If you could share your server config and how the client connects it could help.

[kozlovic]

The documentation has a lot of information regarding TLS configuration: https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls

[edo888]

Thanks for the explanation, it makes sense now!