Can't connect to a server behind LB with TLS termination

[DVrsek-Tricentis]

Observed behavior

Hi,
I have a NATS cluster inside AWS which is available from the internet through the Network Load Balancer which does a TLS termination.

The problem I am facing is that I am able to connect to the server using .NET SDK, but I am not able to connect using NATS CLI tool. The error I am getting is secure connection not available.

I have tried it on Linux as well as Windows OS. Has anybody encountered this?
Just making it clear that the application using SDK is able to connect without a problem.

nats server check connection -s nats://nats-server:4222 --tlsca=cert.pem --tlsfirst
Results in CRITICAL Connection Crit:connection failed: nats: secure connection not available

I have tried this command with or without --tlsfirst

Connection using openssl works.
echo -e 'CONNECT {"user":"username","pass":"password","verbose":true}\r\nPING\r\n' | openssl s_client -tls1_2 -connect nats-server:4222 -quiet
Results in the INFO server message.

Any help will be appreciated. Thank you.

Expected behavior

Expected behavior is that the NATS CLI is able to connect to the NATS cluster

Server and client version

Server
"version":"2.12.1","proto":1,"git_commit":"fab5f99","go":"go1.25.3"

Client
v0.3.0

Host environment

No response

Steps to reproduce

No response

[ripienaar]

This comes from nats.go:

	if o.Secure && !nc.info.TLSRequired && !nc.info.TLSAvailable {
		return ErrSecureConnWanted

So it seems your server is not reporting that TLS is supported at all, so client cant connect.

I don't know if this is a behaviour difference between .Net and nats.go though, do you have thoughts @piotrpio ?

[DVrsek-Tricentis]

Thank you @ripienaar for your response.
Perhaps the snippet contains the scenario we are running into.
The connection is secure, TLS is not required server-side and TLS is also not supported by the server, because the TLS is handled by the NLB.

[DVrsek-Tricentis]

We have been able to fix this by following TLS-Terminating Reverse Proxies in the documentation
TLS-Terminating Reverse Proxies
Thank you!

[ripienaar]

Still I'd expect the .Net SDK to behave the same, maybe @Jarema can coordinate checking the consistency there

[piotrpio]

Yeah, sounds like we should make sure it works the same way across all clients. With tls_required == false in server info we should be able to establish TLS connection as long as tls_available is set. If tls_available is false I would say it makes sense to return an error as it usually stems from misconfiguration.