{"record":{"id":"7c37d2e8edabf797","repo":"micro/go-micro","slug":"error-connecting-to-nats-at-v-with-tls-enabled","errorCode":null,"errorMessage":"error connecting to nats at %v with tls enabled (%v): %w","messagePattern":"error connecting to nats at (.+?) with tls enabled \\((.+?)\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"events/natsjs/nats.go","lineNumber":83,"sourceCode":"\t}\n\n\tif len(options.Address) > 0 {\n\t\tnopts.Servers = strings.Split(options.Address, \",\")\n\t}\n\n\tif options.Name != \"\" {\n\t\tnopts.Name = options.Name\n\t}\n\n\tif options.Username != \"\" && options.Password != \"\" {\n\t\tnopts.User = options.Username\n\t\tnopts.Password = options.Password\n\t}\n\n\tconn, err := nopts.Connect()\n\tif err != nil {\n\t\ttls := nopts.TLSConfig != nil\n\t\treturn nil, nil, fmt.Errorf(\"error connecting to nats at %v with tls enabled (%v): %w\", options.Address, tls, err)\n\t}\n\n\tjs, err := conn.JetStream()\n\tif err != nil {\n\t\tconn.Close() // Close connection if JetStream context fails\n\t\treturn nil, nil, fmt.Errorf(\"error while obtaining JetStream context: %w\", err)\n\t}\n\n\treturn conn, js, nil\n}\n\n// Publish a message to a topic.\nfunc (s *stream) Publish(topic string, msg interface{}, opts ...events.PublishOption) error {\n\t// validate the topic\n\tif len(topic) == 0 {\n\t\treturn events.ErrMissingTopic\n\t}\n","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/micro/go-micro/blob/24529f140421a11a33b6999ab7944f2021cfd69c/events/natsjs/nats.go#L65-L101","documentation":"This error wraps the underlying nats.go connection failure when establishing a NATS connection with TLS settings. The library reports the NATS server address and whether TLS was enabled so the developer can diagnose connectivity problems. The wrapped error (%w) contains the root cause (dial failure, TLS handshake failure, auth failure, timeout).","triggerScenarios":"Calling events/natsjs.NewStream (via connectToNatsJetStream) when nopts.Connect() fails — e.g. no NATS server listening at options.Address, TLS handshake rejected, bad credentials, or network unreachable.","commonSituations":"NATS server not running or wrong port; using nats:// where tls:// or a TLSConfig is required; self-signed certificates without RootCAs configured; firewall blocking the port; stale credentials after auth was enabled on the server.","solutions":["Verify the NATS server is reachable: nats --server=<address> connz or nc -vz host 4222.","Check options.Address scheme (nats:// vs tls://) and match it with your TLSConfig settings.","If TLS is enabled, ensure TLSConfig has correct RootCAs/InsecureSkipVerify and the server presents a valid cert.","Verify username/password/token credentials match the server config.","Inspect the wrapped error for the precise cause (dial tcp refused vs x509 vs authorization violation)."],"exampleFix":"// before\nstream, err := natsjs.NewStream(natsjs.Options{Address: \"nats://localhost:9222\", TLSConfig: tlsCfg})\n// after\nstream, err := natsjs.NewStream(natsjs.Options{Address: \"tls://localhost:4222\", TLSConfig: tlsCfg})","handlingStrategy":"retry","validationCode":"addr := opts.Address\nif addr == \"\" { return errors.New(\"nats address required\") }\nhost, port, _ := net.SplitHostPort(strings.TrimPrefix(strings.TrimPrefix(addr, \"nats://\"), \"tls://\"))\nconn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(host, port), 3*time.Second)\nif err != nil { return fmt.Errorf(\"nats unreachable: %w\", err) }\nconn.Close()","typeGuard":"func isNATSTLSIssue(err error) bool { return strings.Contains(err.Error(), \"x509\") || strings.Contains(err.Error(), \"tls:\") }","tryCatchPattern":"conn, js, err := connectToNatsJetStream(opts)\nif err != nil {\n\tvar netErr net.Error\n\tif errors.As(err, &netErr) { /* backoff and retry */ }\n\tif strings.Contains(err.Error(), \"x509\") { /* fix TLS trust */ }\n\treturn fmt.Errorf(\"nats connect: %w\", err)\n}","preventionTips":["Health-check the NATS port during deployment startup before initializing streams.","Keep server address/TLS scheme consistent in all environments via config validation.","Load CA certs from a managed path and validate them at boot."],"tags":["nats","network","tls","connection"],"backgroundTag":"nats-connection-failed","analyzedSha":"24529f140421a11a33b6999ab7944f2021cfd69c","analyzedAt":"2026-09-01T02:52:24.923Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}