TLS Enabled (wss://)

Secure wss:// using a certificate — covers self-signed/mkcert setup and browser trust caveats.

TLS on (wss://)

No credentials

WS port 443

nats-server.5-ok-tls.conf

1. Setup (nats-server.conf)

nats-server.conf

listen: 0.0.0.0:4222
http_port: 8222

# WebSocket transport, secured with TLS.
websocket {
  port: 443
  tls {
    cert_file: "/etc/nats/certs/nats.pem"
    key_file:  "/etc/nats/certs/nats-key.pem"
  }
}

# JetStream — required for KV buckets and Streams.
jetstream {}

Generate a certificate (mkcert)

certificates/mkcertificates.sh

sudo apt update
sudo apt install libnss3-tools mkcert -y
mkcert -install

mkdir -p ./nats-certs
# The cert's SANs MUST include the exact host/IP the browser connects to,
# otherwise the TLS handshake is rejected with no useful error.
mkcert -cert-file ./nats-certs/nats.pem -key-file ./nats-certs/nats-key.pem \
  10.135.32.227 localhost 127.0.0.1 nats.local

Browser must trust the certificate authority

mkcert -install only trusts the CA on the machine it ran on. If you browse from a different computer than the one running nats-server, that browser will reject the cert (wss:// connection fails) even with the correct SAN. Either copy mkcert -CAROOT's rootCA.pem to the browser's machine and trust it there, or use no_tls: true / ws:// instead for LAN/dev simplicity (see Tutorials 1–3).

One-time nats-cli setup

# nats-cli talks to the core NATS port (4222), which has no TLS in this
# config — only the WebSocket port (443) is secured, for the browser viewer.
nats context add tutorial-tls \
  --server="nats://10.135.32.227:4222" \
  --select

In Connection section, enter:

NATS server host: 10.135.32.227
WS port: 443
TLS (wss): on
Username: (leave blank)
Password: (leave blank)

2. Creation of subject / KV bucket / stream

Subject

In the Subscriptions form: Type: Subject · Target: orders.>

No setup required — just add the subscription above.

KV Bucket

In the Subscriptions form: Type: KV Bucket · Target: my-bucket

nats kv add my-bucket

JetStream Stream

In the Subscriptions form: Type: JetStream Stream · Target: ORDERS · Filter: orders.created (optional)

nats stream add ORDERS --subjects "orders.>" --storage file \
  --retention limits --max-msgs=-1 --max-bytes=-1 --max-age=0 --defaults

System Service

Not available

This configuration has no `accounts`/`system_account`, so $SYS.> system events are never published. See Tutorial 2 (No TLS, With Credentials) to enable system monitoring.

3. Message generation

Subject

nats pub orders.created '{"id": 1, "total": 42.5}'

KV Bucket

nats kv put my-bucket hello world

JetStream Stream

nats pub orders.created '{"id": 1}'

Open Spy NATS