Method tlsHandshakeEOF

nats.go:2704–2713

tlsHandshakeEOF wraps an error with context when it occurs right after a completed TLS handshake, which typically indicates the remote side rejected the client certificate (e.g. an mTLS proxy like nginx). Depending on timing, the error may be io.EOF (read from closed conn) or a "broken pipe"/"connec

(err error)

// Depending on timing, the error may be io.EOF (read from closed conn)
// or a "broken pipe"/"connection reset" (write to closed conn).
func (nc *Conn) tlsHandshakeEOF(err error) error {
	tlsConn, ok := nc.conn.(*tls.Conn)
	if !ok || !tlsConn.ConnectionState().HandshakeComplete {
		return err
	}
	if errors.Is(err, io.EOF) || isConnClosedError(err) {
		return fmt.Errorf("%w: connection closed by remote after TLS handshake: %w", ErrTLS, err)
	}
	return err
}

// isConnClosedError reports whether the error indicates the remote
// side closed the connection (broken pipe or connection reset).