Does the client need to call start_tls()?

[3BK]

Does the client need to call start_tls()?

Observed behavior

I'm seeing this tls error when connecting a client via tls:

returning true from eof_received() has no effect when using ssl

Expected behavior

no TLS errors.

Server and client version

latest. ;)

Host environment

No response

Steps to reproduce

No response

[3BK]

Here is the code which triggers the error:

    def __init__(self, stream_name : str, \
            subjects : list[str], subject : str, \
            cafile : str, certfile : str, keyfile : str, \
            tls_hostname : str ) -> None:

        """
        constructor
        """
        self.stream_name = stream_name
        self.subjects    = subjects
        self.subject     = subject

        self.tls_hostname = tls_hostname
        self.certfile = certfile
        self.keyfile = keyfile
        self.cafile = cafile
        try:
            self.ssl_ctx = ssl.create_default_context( \
                purpose=ssl.Purpose.SERVER_AUTH)        
            self.ssl_ctx.load_verify_locations(cafile)
            self.ssl_ctx.minimum_version = ssl.TLSVersion.TLSv1_3
            self.ssl_ctx.load_cert_chain(certfile=self.certfile, \
                keyfile=self.keyfile)
        except Exception as e:
            print(str(e))


    async def connect2q(self, servers : list[str], seedpath : str, retries : int) -> None:
        ''' connect 2 queue '''

        #async def error_cb(e):
        #    ''' inline call back '''
        #    print("nats connect error:", e)

        # connect to nats broker
        for i in range(retries):
            try:

                self.nc = await nats.connect( servers=servers, \
                    nkeys_seed = seedpath, tls = self.ssl_ctx, \
                    tls_handshake_first=True, tls_hostname = self.tls_hostname )
                #error_cb=error_cb
                break

            except (nats.errors.ConnectionClosedError, \
                    nats.errors.TimeoutError, \
                    nats.errors.NoServersError ) as e:
                print(f"MQ connection failed: {e}. Retrying in 1 second...")
                if i < retries - 1:
                    await asyncio.sleep(1)
                else:
                    raise
            except Exception as e:
                print(str(e))

[3BK]

From what I have read, the nats-py should call start_tls(context).

import asyncio
import ssl
reader, writer = await asyncio.open_connection('your_server_uri_here', port)
context = ssl.create_default_context(purpose=ssl.Purpose.SERVER_AUTH)
# Adjust the ssl context for your particular needs (e.g. self signed certificate or what not)
**await writer.start_tls(context)**

[wallyqs]

there is an option called tls handshake first which would start tls:

nats.py/nats/aio/client.py

Line 348 in 8f53949

tls_handshake_first: bool = False,

[3BK]

I'm setting tls_handshake_first to True and still getting the error.

                self.nc = await nats.connect( servers=servers, 
                    nkeys_seed = seedpath, tls = self.ssl_ctx, 
                    **tls_handshake_first=True**, tls_hostname = self.tls_hostname )

[3BK]

Please see the constructor and method listed above.

[3BK]

BTW thank-you @wallyqs for responding!

[3BK]

Invocation

python.exe fuel_data_pump.py

Response

Sent 1ae4b4c990ca65962cc2516a33be7f76 @ 2025-09-04 09:32:10.361966

Error

returning true from eof_received() has no effect when using ssl

[3BK]

It looks like client.py:_process_connect_init(self) is calling transport.py: class Transport : connect_tls() instead of
class TcpTransport(Transport):connect_tls() . Do I need to manually call start_tls()?

[waza-ari]

As far as I can tell this is already being tracked in #574

[Brent-Durham]

Let's mark #727 as a duplicate. Good catch.

[Brent-Durham]

More to the point, it appears to be a issue in python - not nats-io.
encode/httpx#859