Able to create connection,publish,subscribe without passing ca pem file to a nats core tls enabled server

[vishaltripathi24]

Using nats.py2 able to create connection, publish, subscribe without passing ca pem file to a nats core tls enabled server running behind nats streaming server, whereas other clients in other language required ca.pem, gave error : Can't connect: x509: certificate signed by unknown authority

Nats-streaming server configuration: nats_streaming_config.txt

File :
nats_pub_sub.txt

The TLS handshake should fail as the server's certificate is not found in client's truststore?

[vishaltripathi24]

Is client's default TLS context enough for successful TLS handshake given the server configuration above?

//Client Readme says : The client will also automatically create a TLS context with defaults in case it detects that it should connect securely against the server.

How is TLS handshake complete without providing ca.pem file only for nats.py2 client, am I missing something?

@kozlovic , @wallyqs folks any input on this?

[wallyqs]

Seems that if the server is configured with tls it should do the upgrade:

nats.py2/nats/io/client.py

Lines 924 to 937 in 7b17b27

	if 'tls_required' in self._server_info and self._server_info['tls_required']:
	# Detach and prepare for upgrading the TLS connection.
	self._loop.remove_handler(self._socket.fileno())
	tls_opts = {}
	if "tls" in self.options:
	# Allow customizing the TLS version though default
	# to one that the server supports at least.
	tls_opts = self.options["tls"]
	# Rewrap using a TLS connection, can't do handshake on connect
	# as the socket is non blocking.
	self._socket = ssl.wrap_socket(
	self._socket, do_handshake_on_connect=False, **tls_opts)

it would create a default ssl context in case none provided as a connect like nc.connect("tls://", tls=ssl_ctx). You could try with passing a default context from ssl library and setting with an option too: https://docs.python.org/3/library/ssl.html#ssl.wrap_socket

[vishaltripathi24]

@wallyqs ok but how is the handshake success without the server's authentication given the default context(without certificate)?