Function TestTLSHandshakeFirstMTLSReject

test/conn_test.go:3526–3570

(t *testing.T)

}

func TestTLSHandshakeFirstMTLSReject(t *testing.T) {
	// Test that when the NATS server itself does mTLS verification
	// and rejects the client cert, the error is a clear TLS alert
	// (not a wrapped EOF).

	sopts := test.DefaultTestOptions
	sopts.Port = -1

	tc := &server.TLSConfigOpts{
		CertFile: "./configs/certs/server.pem",
		KeyFile:  "./configs/certs/key.pem",
		CaFile:   "./configs/certs/ca.pem",
		Verify:   true,
	}
	var err error
	sopts.TLSConfig, err = server.GenTLSConfig(tc)
	if err != nil {
		t.Fatalf("Can't build TLSConfig: %v", err)
	}
	sopts.TLSTimeout = 2.0
	sopts.TLSHandshakeFirst = true

	s := RunServerWithOptions(&sopts)
	defer s.Shutdown()

	// Connect with a client cert signed by a different CA.
	_, err = nats.Connect(
		fmt.Sprintf("tls://127.0.0.1:%d", sopts.Port),
		nats.RootCAs("./configs/certs/ca.pem"),
		nats.ClientCert("./configs/certs/client-cert-invalid.pem", "./configs/certs/client-key-invalid.pem"),
		nats.TLSHandshakeFirst(),
	)
	if err == nil {
		t.Fatal("Expected error, got nil")
	}
	// NATS server sends a proper TLS alert, so we should NOT get EOF.
	if errors.Is(err, io.EOF) {
		t.Fatalf("Expected TLS alert error, not EOF: %v", err)
	}
	// Should contain a TLS-related error message.
	errStr := err.Error()
	if !strings.Contains(errStr, "tls:") {
		t.Fatalf("Expected TLS certificate error, got: %v", err)
	}
}

func TestTLSEOFAfterHandshakeNonTLSFirst(t *testing.T) {
	// When the server requires TLS (but not handshake-first), completes