fix(inigo): use TLS NATS (TNZ-1234)

src/code.cloudfoundry.org/inigo/fixtures/certs/nats/client.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEMzCCAhugAwIBAgIQJBLOmgdTLJ6Own+/NJj1EjANBgkqhkiG9w0BAQsFADAS
+MRAwDgYDVQQDEwduYXRzLWNhMB4XDTI2MTAyMDE5MjU1N1oXDTI4MDQyMDE5MzU1
+NlowETEPMA0GA1UEAxMGY2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAtpCVOuuYvve58KDejU6+cJgpe3AbWdVQV1GM1aMlj3KgD7QnImfrLYWu
+Gz1BtY8Nsc7lXGX7G3k+pZLvGv8mE9ZDLHBE9pCljVeB9Qq5gnJtZHcqf3RMLvb3
+7jAqVR+qKF+hOhdOkwzIkyAU8s5muRbKsGoMKFf+iqAJo3N5vRfqnsUSrdbZu7TR
+N9NHAQFUz7fuiKznfGbaMR+tvlcgCAc8O75rY/a632rbzzlGoHVz1lgUTIEorQgE
+OhIFMuwXb1kX1GttSP+AD/ezsNSSyW5alQ7u7uu1rKbKC2xhfqpIhFBkOLi085MI
+65mSHhscfgOZ/uymWxUbNX4K3eGehwIDAQABo4GFMIGCMA4GA1UdDwEB/wQEAwID
+uDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFOIX8+eS
+lLkCkaPjulCG927WmoWPMB8GA1UdIwQYMBaAFKTfj2VCnyFy4z88Kil1bF9Zjs/E
+MBEGA1UdEQQKMAiCBmNsaWVudDANBgkqhkiG9w0BAQsFAAOCAgEALTpu/wTAfXqO
+OEfE/UI2r34A38hmUNixJSzFVEZJ5SK2kAkAEg2qGvuTCtIG+F3P83wR3a/QZ7tU
+Shmy+fn9A5X8uCechma1n4O7uwBtxZyAIwrDiFHy92UflrBOh+MzE3yNHd+xuZx3
+oTOL8s4yaNKrmoFVwQ8hzqi4ExN7fp7iK08WFoFIpibV/zydnsF49l0JXteZwBBo
+tfkDAKQCEXwqZs7HQc5yGbhbFnAqsO43jzSRo3GbgVtnUCn/o5cU+1Lfm19Z3+Wq
+Pv0h9cq4jfEf2zPVzpY6VOQYB92m5OdPqJkUuogLqrvq+YQby6B2NLVfYZCwev5B
+DT6ESMKZn7vr7WZqFWxT0hPXDKd939GkUl6RAC646oth99RJ3+au2ZQMVJCDY5NP
+6YwyQ/EbNT8e5DAI8XhJwrG+u/6orwLWmDGOFBQiKg+ES36zxE44IdfIFBO5007H
+zzbjeh3sDiS9+1jwEIb5d4ODkKz34DOtBTuXt+7ZKaW34FEtmuoCu2x36JlWKgWV
+Z9kHoyf21Lxhqkh2vsSJ0208Ln7yw31HNEXGkya5HeNcLZd3lrTEFU52hOVc2Ip7
+T9sHTC0Ky/i8kHKL0poW1W9vArsCTIDvY/4cnTrf5svF8FKuQTYyEbPjgBvHict3
+uJPK+9bD6hq3P1+VTz8TZPK7N7PMWY8=
+-----END CERTIFICATE-----

src/code.cloudfoundry.org/inigo/fixtures/certs/nats/client.csr

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICejCCAWICAQAwETEPMA0GA1UEAxMGY2xpZW50MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAtpCVOuuYvve58KDejU6+cJgpe3AbWdVQV1GM1aMlj3Kg
+D7QnImfrLYWuGz1BtY8Nsc7lXGX7G3k+pZLvGv8mE9ZDLHBE9pCljVeB9Qq5gnJt
+ZHcqf3RMLvb37jAqVR+qKF+hOhdOkwzIkyAU8s5muRbKsGoMKFf+iqAJo3N5vRfq
+nsUSrdbZu7TRN9NHAQFUz7fuiKznfGbaMR+tvlcgCAc8O75rY/a632rbzzlGoHVz
+1lgUTIEorQgEOhIFMuwXb1kX1GttSP+AD/ezsNSSyW5alQ7u7uu1rKbKC2xhfqpI
+hFBkOLi085MI65mSHhscfgOZ/uymWxUbNX4K3eGehwIDAQABoCQwIgYJKoZIhvcN
+AQkOMRUwEzARBgNVHREECjAIggZjbGllbnQwDQYJKoZIhvcNAQELBQADggEBAJqU
+9QDvdL+D0x6tPVBwdRXQ5q+skhf359sewSHChEep/dPYJD2TYMTXAL2ih3benk5m
+rb2Qk8JpLdNdK3e/J84zCtDeIvcaRT6v1bIiowCClWEF8vxYxhHkNwOxDf3E3ReI
+VG2Ue3YB7JKtjb7mwKTZNzcif07kxGnWkL4Hlr56wBFlf+C/fLPJt0Wni+BUJRJQ
+E894TK5CNX/4aLtOOHBegAMlmQovejGI0EIvbFpOjTGxmYVdua2CZcwLMGlqWaly
+LznSjJ0BnZemGITcn5avfZ//Xmcf00E2L2vm2wH/GT2bNQadCzByqlCTlQKS9SXA
+MdOb7Ew6I7lbX3kzA6s=
+-----END CERTIFICATE REQUEST-----

src/code.cloudfoundry.org/inigo/fixtures/certs/nats/client.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAtpCVOuuYvve58KDejU6+cJgpe3AbWdVQV1GM1aMlj3KgD7Qn
+ImfrLYWuGz1BtY8Nsc7lXGX7G3k+pZLvGv8mE9ZDLHBE9pCljVeB9Qq5gnJtZHcq
+f3RMLvb37jAqVR+qKF+hOhdOkwzIkyAU8s5muRbKsGoMKFf+iqAJo3N5vRfqnsUS
+rdbZu7TRN9NHAQFUz7fuiKznfGbaMR+tvlcgCAc8O75rY/a632rbzzlGoHVz1lgU
+TIEorQgEOhIFMuwXb1kX1GttSP+AD/ezsNSSyW5alQ7u7uu1rKbKC2xhfqpIhFBk
+OLi085MI65mSHhscfgOZ/uymWxUbNX4K3eGehwIDAQABAoIBAQCjQSWBe96qnsJS
+sLhzKoBYFWm67WQ37+4ZN162SF81KK6DfHkmZkFDAvDPgPa6kcMQRtCJ0NQ9HC3u
+SDezL4jwYkDNg1PYHT895ovbAY0kXoj+NyX0tZ3OvaC2CbJBTsCNu/5kASWNj/fo
+wN6axgHL79qu6RYYGaAQfM5BsOijMzYxjqBc4+98p5DxcytF/pfAPQ/gPRivGFke
+7ynGcNsYff7s8dhznSks6YNKOEssk3W26Cgf6gZg8Rz2RK3gtYICf3eytpb7ETi4
+51wV6YJrVPX6ZFGGsPg4e/a5K7ZI9NDZTDPngtIWngf0bt51W3FPzjqGarhj8aF7
+QHmFnFmhAoGBANRjyv0IJHosH8tWBGC85DgO4gyeqmdf76vwxvQcHdWL3c4NJ2tw
+q8qKYqBJXaCgLVfOyX2P07uhjkicWmlcoBz6qPoBrZiskGil1PXayAZ7MdONvqwM
+9KdvsUPCPrcFrYSji2+JuaiHexWDS2CuD8GrYY4NyqMb+evHzipn2yc3AoGBANwN
+C7cPTCD/HIpPJzevTCniiGX6OGr1mwwYTmDJIPvZ3CQ6aCqS0nWpy2vpMX27IT59
+JnaWKGLMD09memnhXloy1/Qxdf8QIUSd0Nvx9HyGHhV70lR5NnlT3qAZ+23mW843
+lDSa6HL1yc84EV/vvKCtq8pspvTHyJkCUPBQHksxAoGBAM2hLJecuYxbihDY3/Y1
+C5RGvI7RU1QwqyBCRq1zR2NIPmBPlfnMpVa8cs6TGYX5bs0T1Tqu9KU1vkcIsfRO
+jGpiORWMaGFnuYzH+Y5q2ryDq/MRyihThs9RMUPUHdofMic4HDjKFClZuk5Sxrj8
+7R5p6lKZgbY30Nl5ol6mHKUzAoGAEsQWDK2ES4gWEgGAEbKkZyoHgdLd/tklONnV
+zVE5u+CvcnN8sKzGv/wT+gbwDo3n3uFjZ1eU6CAI6jeOFvt+RWjym8OgEXl5rNVc
+m3U96WSyqhheLpALwjsR0EuG8q9jgumgfP/89NjbNg3NBYZ3aqiE7wVnE5b6F3po
+FqZufvECgYA9yEQ59cg2+yF7W71lvkVpNUTD9+LtkPNRKEEmyxBRVZZw1jiAKnVE
+9u7//4O8fRWEymfJoPd0XHipu+3i7690Wb65gcJGf9wFAn1LkFOU9SPiW5PxnHjH
+Wc82WaQ3VzuggRpqlQTzUU0IsqfcZSSNNS1jAx8CE0jnnQNHvV30pQ==
+-----END RSA PRIVATE KEY-----

src/code.cloudfoundry.org/inigo/fixtures/certs/nats/nats-ca.crl

@@ -0,0 +1,16 @@
+-----BEGIN X509 CRL-----
+MIICgTBrAgEBMA0GCSqGSIb3DQEBCwUAMBIxEDAOBgNVBAMTB25hdHMtY2EXDTI2
+MTAyMDE5MzU1N1oXDTI4MDQyMDE5MzU1NlowAKAjMCEwHwYDVR0jBBgwFoAUpN+P
+ZUKfIXLjPzwqKXVsX1mOz8QwDQYJKoZIhvcNAQELBQADggIBAHG/dqAVHBJsW+UV
+9zQzLdBPMxlTnupKLPEYk86inxSNXj9VcfNAP+u15I5jw7Ih8oT7eSY7pBHp7sje
+tx0kXOK6FQNiXja/adAW7Pbw4xO2c8RaG+h/sJi+IcgVwSdrk3LktcP3Nrh09Vpe
+k7CL7ALhwGKV86LCCPvVdb0pIQj+YUESUsmsMeZE7Qn+mAw58PC9HmbYs1cghlyW
+9KQA3lux4sZXVHhvsV0PYWL0yRf8PpT+X00Kiq4guYOowZa8BKoBN8fxfxSYOjns
+hnzzM25QY0cY7YdNQ8rE9sduoZWHV/hucW+U9ljsPZgOsSgzxxYj1J/dCKa556fA
+K9fCJ7sVBj2VJV6Iv9WCY/G4OU8amKzMOQ/MCaAVbgrpIzWs4WvCAD/b1j6sUBog
+VPbz+I1Ki82AnfkYH6wCufuifVbqDNH0HVO7POTTUpVb189AZQurVutiItuAN+DN
+ox2u5fOZseugVAm0z8vWVnE7YV9RMTxIdW/3poE1ahITUGAJK9TFuHSKXyrI1ZTA
+8SOHTrDQITddrsFwuWrCEBbgIe5k2DQjmAIMa9dWFeMostbE0Lc+a8n/4M0HfWBA
+JHa5XucyG3MdVPMJREPHOFVWoQDvzFtXfZC6IFxixoNMYrYAgcY7PLe10sT/LGXf
+CQJ3I2qSi0Z98Tq70apAlgmPirWA
+-----END X509 CRL-----

src/code.cloudfoundry.org/inigo/fixtures/certs/nats/nats-ca.crt

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE5DCCAsygAwIBAgIBATANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDEwduYXRz
+LWNhMB4XDTI2MTAyMDE5MjU1N1oXDTI4MDQyMDE5MzU1NlowEjEQMA4GA1UEAxMH
+bmF0cy1jYTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJ/tnwXhpCeQ
+dNE7dtMtliwhSAI1fpbckCzOyqn4SBt13xrQ9ZaCBoZVm+OOBsCmhFr45FeKuk3G
+JcWi24/00m+xg0Pn2UvFOTO38K3kS1OIMpJa4DX2nWHK/F7IwLprluZq0SyIEy/6
+40X98kj6Yujv3iv+P2B5ulS+O3+cjFvnV9og7+MUmCwSG835wJrcFCSY+LEDC9AK
+cCottoG8DySQSJZYwcppFMgiIgtF/cytfd656zzSdsTBjZmJteIY7OsBbAe86Kao
+1Z6fIkZwGVnekjzRs5QAUfg1Kv+KjIkA0txBakPuerBYE6xeCRd4zCGIJzFZf3GM
+pJywvKXjlS82QuTVhul1eRjYuuJjqW7cumq6bPtCWRk3ng/38yAn92uBa/WhiZyN
+BFdHhVQiflMyQ7SztS74z9S5wNpV9p7Kt2Irv7O+VjJbOfHfh6p+8lV7X0xvOa1p
+pMVjWQplWuLzdalxsdEe1alnOHEUCsfLWDVFmiCi04abIfDfZsxEJXnvvSZ0uCAp
+pPRZFx8G595D4JY6bcwGPQECfyJVsY3Q4vvliwJa5QtnlYY5rVqw17LFrEREWmTE
+wytI0nKVDo/+mIGf1u7y6U/SEXv8lq7YCXuamscZeBhn7iFOol4zTABMBnmX6JMn
+ELP9yF3w/AVFC8Nf6Uwp6z0jtPH32Nq3AgMBAAGjRTBDMA4GA1UdDwEB/wQEAwIB
+BjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSk349lQp8hcuM/PCopdWxf
+WY7PxDANBgkqhkiG9w0BAQsFAAOCAgEAJIgQOy96RN+PJ0UC3WjOGqe9Czayonda
+aoqogo7v10lJBkOiAk8uH9m3y8FQwwxYw7i9hK8s/v72gfpZmKEuqhbKuA8HROhY
+gS4fNe6A6H7wOgfneZNDGyJgtlAS4yWcrTm9z9G5DJLNpdAdC0HW9aeEb0wpQ97v
+DRj+hmFhnyw35cLij02lO3k+bzS73Dybe1RDZdnuUQd531mjVYaLEsLfRuA6ZChr
+tT0Y6KMZh086ZBsACu2RkFdaA7MVnVcVJtxgCwZNu8I6CyfAxj4I73lSTPEz7oO9
+llaXa9hHqSG3EI5bspbHx+rZHUScRrfJDXZRq43lIAbshrkvRa/nl66hjSh9MCvi
+piVToAnMm5P9tMthkBMHfuBNs06KhKx/k+sCaTUw8KuRG2ZOn2HW4zk6YDG902yQ
+Ys4yO5eNohyLwWPjwooW0LK26YRO4VHj8GeBlbvU6Uk1JElj1o60ockZKQtq7Yk+
+F4A1bXUxbTq4ZQ9zHO3WmghH/Z8fm9fY/d/bcddwIEaLihj0qz5AvtEIDzYhynYR
+i1NixkfcSxo07ovu5jbRGj799qWmfEDuu3oc5SXCV33LoUGEaFEeZm1LsD2Sknh9
+Stbf582Iugm/hkWRIY5k6aXdw6pEybzEQ1MRtrflrn6KWtHCEPPxzoM+PyocYRR+
+FsAf+fFIuGw=
+-----END CERTIFICATE-----

src/code.cloudfoundry.org/inigo/fixtures/certs/nats/nats-ca.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAn+2fBeGkJ5B00Tt20y2WLCFIAjV+ltyQLM7KqfhIG3XfGtD1
+loIGhlWb444GwKaEWvjkV4q6TcYlxaLbj/TSb7GDQ+fZS8U5M7fwreRLU4gyklrg
+NfadYcr8XsjAumuW5mrRLIgTL/rjRf3ySPpi6O/eK/4/YHm6VL47f5yMW+dX2iDv
+4xSYLBIbzfnAmtwUJJj4sQML0ApwKi22gbwPJJBIlljBymkUyCIiC0X9zK193rnr
+PNJ2xMGNmYm14hjs6wFsB7zopqjVnp8iRnAZWd6SPNGzlABR+DUq/4qMiQDS3EFq
+Q+56sFgTrF4JF3jMIYgnMVl/cYyknLC8peOVLzZC5NWG6XV5GNi64mOpbty6arps
++0JZGTeeD/fzICf3a4Fr9aGJnI0EV0eFVCJ+UzJDtLO1LvjP1LnA2lX2nsq3Yiu/
+s75WMls58d+Hqn7yVXtfTG85rWmkxWNZCmVa4vN1qXGx0R7VqWc4cRQKx8tYNUWa
+IKLThpsh8N9mzEQlee+9JnS4ICmk9FkXHwbn3kPgljptzAY9AQJ/IlWxjdDi++WL
+AlrlC2eVhjmtWrDXssWsRERaZMTDK0jScpUOj/6YgZ/W7vLpT9IRe/yWrtgJe5qa
+xxl4GGfuIU6iXjNMAEwGeZfokycQs/3IXfD8BUULw1/pTCnrPSO08ffY2rcCAwEA
+AQKCAgB9Tjw76nio+zlcOuA2RFCWkRkPigR+haB9SyVlmYA969P7+d+CpqwgEvGK
+kNxfk9i+Qqb+pFam22r6+EhZ+bPsCcTUrtMF2CiiiiuMxAP1FhCxtXxZK7pSRi4I
+wfin1+aq8OSlpJSMEmKCk5+DaJOY+WA1TgcwOxAwl8CckvcyhwfBg+8RGDDGzwV0
+FIzBiVBLAIRShRV7UsJheeG2sreWqWoGStLEGiNLT9smxBdAiGrH2RokVK70KMce
+ltSoq2juFPYk9fG/qyd9GihL0kc6r/Yaqx+uBbYz6Myg3liQe9G6+5IcWb1NcCUx
+95feCSq/1yMGOp5tRIoxrxSQUcmvr/8PbUUheiFMtto9x0BJpeBRkHUTynoPz2zr
+XCSlaedxoUj/d6Uk8RtENCcJU7fO/IPzXcGLgh+tm/502h3ALrsuFyQccNsdBKG3
+ikVwuwfcubPwWywaEOWUN0tg3M5H4fu4blbmtpLfwROb1ptK9ZOjM1oxUv8xHTtJ
+4rBBgSTYOgjsl35Ch0wvMxV8nP5c4qH3nGjR9a6O5a5p2r1w3PQX2q11Cusm82Qm
+rUtC5ceOtxxfyP6HY28w3pZu/+kj3zerkXXrlIZ7gNRlwKZ9VTzunBnLM5z2JrAD
+ReLNCHlSM+8A1I1ZHyTXYbyqdbb+xBon2kvu1gvKDe1JmCB+4QKCAQEAxQ6R/dKU
+8oemUwWtn/b/8qsUiaq7Iqb3Ecjge6D1ZByoZrNHQt4S40iFKYILiIlBZm2Pr0/1
+dyccwwOVnxSUak46bXiHnZJWO6lJQUbLEGrCPWHeeY8ImLYvt96UyDJ/mjzMjQoy
+D5GtMWLFduIhsYcSBFJZQ/He9fOV7xTUL0eGlmy1k+EyMY4vapz7bSGV24aXCmwZ
+enxyuOkea/+GSDHqcdllxPZ6SmqTl9u4+8gRUMF3sII+L+j3EVR6WON18+qNVW8Q
+tUwK6LRsgjFm1nVybgu/OLca0J58BdqYXChwBv7wDZ/Izeqc4DsiTZMGFIiauk0b
+l1Hm/5jFRVQKkQKCAQEAz8P1X3n8diBmx9xMl7b0omN+m+TQS+XfE1aCnQfe1987
+QEdqv5XA0j1gj4QtFSxM3iIxocXaJAK6XlPZ2Pc8wzdmo31ueuUfqbv7UpLhDf9f
+bNSQK2XeJjh1h2zgz57FJw9hqp87AOEms659ZHAthwLdNsEJm19yvz+KJX/t6gKN
+XcP4udGhP+Q0NNV8GILGYEVTZUT8GrVj8cjzCoxgQPh58GJmCZv6VHx8MxTZn9Sf
++49V+Ijk+kEeMmuZpgjaPFE9eh1MyCGDoeq8OaNLvyPps1MS4P9SBGIEcqcz9/ES
+daHI2SEF1Sm/PP/7qFk3IZdV1UmVn6mu9DpKEyRkxwKCAQEAxPFR8Wb0HAx8q38C
+TtySYxqetRQgYXqTdX/Y81YjyoFlwPauYuMF54fEJn7lPflHlrIrJ2B3iDVb5n9/
+mvT7e99hP6V1jIMDki8XmpjBPFAmfyiAK+dLBS0YNeDLu+XUZ/cZzGADNlI20SPR
+DIbme8HtvMn8kw558kAXelHL2tDWbyKIuxoXizV6qEfqdOBbIIK8E9uD/0m/cpTy
+JafEsgTJNi27K4XXJOatSdl8YI9M1vP0xkD1G/bubrCKcqoqabPiux78iOVOBdLE
+m7359J5+1gMBgxJlR1kNxN/65Cg6BpPmoQcvrrUrQmN3XiZxrjX0xftoduyRPKSX
+jDl5MQKCAQEAuLY1+xk/q2GpHvyrl6JPoeOk10I5MZD/n3ilDKjHpNJRIhecPxIL
+aJ6qr01Kq21ENaTezT1Sb/uA54XSwsMj4Ubq2GUWiOoVGVkH2mS88y3cD6x3NC4P
+r5k4XBsfT1aPXuec5A1GbsS9HLf/wQC+aS7RrvE18k2MfZ0m26n9wbNdLUSiZ8mI
+e34OL/6wojX52fMobntDSxeC8J2//dvJY1nFR0KkBt0GVICMBvn9dMybIxJO03QZ
+ZqfoCdmBs4xhQYjUiDFuZurs1VIU34VfPWLXTdeIjEJSD5V48NnYKRHJYI1iPC/Q
+uK+x1rCacxRGIHYkGEigXl+ELJt56cTMVwKCAQBd4vyNET12OMU/zJqJwkrbCFWe
+AuCgRTAkTZ2+PSghTnbByuSirfSW84If4xIs3TOPgm8MDaMZu1mZKUl1IcHHF+Ci
+AnD9fDG7xi4CpbmKMuJ41LOOhguuIF9RQ3ZU+27Qf829uQ5SATYL68PNvI5zK42p
+ZdGWTpli40cdnbEQxUj03Uq+hKyXJ/wIIHqwsn2sdIEygkWTSGBS1VMc70HgaxRp
+eLICZKWAfci704PBARtUwOkA258lZ0B7/wJ5eugSbvp7ptbvxqfnc8cm4hb8Kn+8
+MAif9ODynXtXGyVtzm8WQ0CPp7tfOhujB8pFf6PeQeSHNO4D4yOdCW4fhZnH
+-----END RSA PRIVATE KEY-----

src/code.cloudfoundry.org/inigo/fixtures/certs/nats/nats_server.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEQzCCAiugAwIBAgIQJjtc7RrcbWHkt2Qbfqok8jANBgkqhkiG9w0BAQsFADAS
+MRAwDgYDVQQDEwduYXRzLWNhMB4XDTI2MTAyMDE5MjU1N1oXDTI4MDQyMDE5MzU1
+NlowFjEUMBIGA1UEAwwLbmF0c19zZXJ2ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQC19zMv11R22FtkNrLZ4UlNsn4hvoPeLeFQeeuSzk556hPSYV9l
+bIT8i/Awm5W9XJfTZ0rQPR3pHv1/3/n+zaN5AKt3jcmeWsl8F+emb6Lf2HerGKZD
+OE4CqzO9FKIqmEOwYjHdju2sRydMKgZacspa0XHQaqsstOIhfDFMZroHoDJb82hM
+CFJH7lBRkEOP2KkN7jDbSnFsZTucsjUq5vwxWF0hNXPiKx8/BlSVhCPC/yWITlb4
+csKXQKK+CWDwwD5Pa0IdGP8aA5QZB44Oix/anxyxt+lMv9rhD8TqT+0aOtzn9f2g
+hW+0eFsiT60ZEvZrWTozn4FcyUy3JH/6oBVHAgMBAAGjgZAwgY0wDgYDVR0PAQH/
+BAQDAgO4MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQU
+I4kfwzwrc/Ki+epLqLXIeHuVqE4wHwYDVR0jBBgwFoAUpN+PZUKfIXLjPzwqKXVs
+X1mOz8QwHAYDVR0RBBUwE4ILbmF0c19zZXJ2ZXKHBH8AAAEwDQYJKoZIhvcNAQEL
+BQADggIBAB/2m31dHNR6TlO3BZZqigUyQDelEfAMNgDTG6/TnzvUQVj1/8WDGCTv
+ZYJ1Sltaeov+zxA5QACRSVmm32HDTdm/+CM7jcc9/16qG8w/hyIXVP8iOLW6Di+t
+ZLgaN55zq6VnvvJydlrBSQxB83iH7MtRjpAlGNqMOkM+b4UFrtu4bbMeFqhYu0+k
+tYx7z/wxIG2AOYyidm9gMVAhe2BiRfbRHQ8jQcbQGbMB1petIjGjCS05f3yCbhuY
+TMdhwTs2Voj/mltsC9rQU6Kw5/6PhW/SKpi6G0Qcd54BlvZ2L/2TimAnV3crdRn2
+vpyIF5D9tOgSZME2qb7JTGlup6BsQombMvOMYSfdAfeepzQ+X6N6SSJdorpqAnRk
+uVr69cpp9LwZrRX4ak0NJmNowaUA3TYxj/xtv1rclFcqbmn4a5PEhLUxxOOSQPK4
+QKYFqjf6kBA3wkMH0+X8Bl2LgB+jT+weL+HQicu+K5tYDtj5h6zDFc2egdLysdOF
+alBdxlDE8KgjG79AO2TZc3ZkqT48VRT9xb9vQ7zOtP2i6+PqmZnvQP3k7MzeykC3
+4E+Y+vfirbDZv7wfTdtdPRDrWCoCkqk0fWQYUxQLCAQF9PJzePfjwxy82C0UCzXU
+65qDIVe6KIFfmUivUWEwXAH+g63A9eTUa/hMYezgNsrKUq4eno6b
+-----END CERTIFICATE-----

src/code.cloudfoundry.org/inigo/fixtures/certs/nats/nats_server.csr

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICijCCAXICAQAwFjEUMBIGA1UEAwwLbmF0c19zZXJ2ZXIwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQC19zMv11R22FtkNrLZ4UlNsn4hvoPeLeFQeeuS
+zk556hPSYV9lbIT8i/Awm5W9XJfTZ0rQPR3pHv1/3/n+zaN5AKt3jcmeWsl8F+em
+b6Lf2HerGKZDOE4CqzO9FKIqmEOwYjHdju2sRydMKgZacspa0XHQaqsstOIhfDFM
+ZroHoDJb82hMCFJH7lBRkEOP2KkN7jDbSnFsZTucsjUq5vwxWF0hNXPiKx8/BlSV
+hCPC/yWITlb4csKXQKK+CWDwwD5Pa0IdGP8aA5QZB44Oix/anxyxt+lMv9rhD8Tq
+T+0aOtzn9f2ghW+0eFsiT60ZEvZrWTozn4FcyUy3JH/6oBVHAgMBAAGgLzAtBgkq
+hkiG9w0BCQ4xIDAeMBwGA1UdEQQVMBOCC25hdHNfc2VydmVyhwR/AAABMA0GCSqG
+SIb3DQEBCwUAA4IBAQCcLWARyFSFLir923zJbbREKYhrZBcZRBCOYnlo8Apfj7wU
+knFA66uyqR1CKRD/UJV8CHHMMOzpdCrO3BURKU5hMUYK1nbY9rTrd3EuysqICiDw
+W5zCiGtTb4ytSTPgo+Nn6hseku/80BW2AhbIfw4pxxx4Vyjy495EsAxTj/+k22j+
+lPOGkO+oNdpvkKnRIO8ks3eL8quVElWl+YEPjv0d6cJ951KN6Sk9U6u5yrFs0O2P
+5tT2PXL7KlTjjRyvoIi2kGtU/EAEDQppBEjJdTZCRD534HpxbObPee06COCu/Ids
+xt/jrdCjwF3vGn65IGqkriT7jwLg1sVmYlM3pw1Q
+-----END CERTIFICATE REQUEST-----

src/code.cloudfoundry.org/inigo/fixtures/certs/nats/nats_server.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAtfczL9dUdthbZDay2eFJTbJ+Ib6D3i3hUHnrks5OeeoT0mFf
+ZWyE/IvwMJuVvVyX02dK0D0d6R79f9/5/s2jeQCrd43JnlrJfBfnpm+i39h3qxim
+QzhOAqszvRSiKphDsGIx3Y7trEcnTCoGWnLKWtFx0GqrLLTiIXwxTGa6B6AyW/No
+TAhSR+5QUZBDj9ipDe4w20pxbGU7nLI1Kub8MVhdITVz4isfPwZUlYQjwv8liE5W
++HLCl0Civglg8MA+T2tCHRj/GgOUGQeODosf2p8csbfpTL/a4Q/E6k/tGjrc5/X9
+oIVvtHhbIk+tGRL2a1k6M5+BXMlMtyR/+qAVRwIDAQABAoIBADpTnY21OPbLTSgn
+PFcIlqWYFEQevEgobrOMEQ3CoXcEqAvkeF6bVVlaRche5rWHC4eQ8XMkVAUYkOs/
+UPPy2HZ913h/82OV+EWVqAQ6fnu/+EPYp9qeHqtOU0xFY+HBYtkT8KXzHY3+VMNe
+KSEu8FwCDLhgqLOw21ceZvL1bqXokjnClVXzRByU9ALt4FWJ//9/xjI4bHzp8eSd
+6h4RabIdUL8hED1xHwN1oild4itASxywiIyBOnM6ycQ5SNipM6pAdAV28ERIS65M
+uKzaUISRtmaGn3NtjuXxDFsflb8fBEnS1Ip1pFqE4rE1Vw0ooolV2EcFOVZ4jIkk
+JSdI5IECgYEA20ViXfZFuvmi8ZRA1jLq6hssN73w3A07WivLRWNHh24kANAN/kJN
+rb5YNpoE3u6AGyGk1eLXGLd/jrML9vr4cZiQWBk2wo4oDn+Um3HEHMRdaVk7Qthh
+VhUP/D2wVP7sbOS0FA6zfv7tKEF/hhh2Lse8Ddfyq7Weh6z5+RkCjocCgYEA1HIc
+/Oxmt4dQWNrZ+8fS56USdLWWVhiDgHqkMeQrT23Zyvn2cPNvXsC8ejJu1cYMukaL
+Bep1bFO6uq4IA+ZHXPJ4OaeF/RbGmSa+3o8LHg6Qb/bM4sbVpi56bKDT4z1PM0cP
+rPBMkw36RnwnJeMpY/FC2i/PZBEwtFLfyLUDM0ECgYEAmOvY4IMCupWjSCwG09wK
+7V4qBm4XbsBjpk1opGnK1u6/eTmgqLSBDCz1xI7B2uAmw8VA+lILhRdkhJbmP0dk
+wYSPFoHvKNyPnxzm/UnoZc+k/fXXWJUjvS9PSLGVKpHnPUJ7PInMMUOFDlAvqcuh
+kJqH0nfKrGort5+xbkI9AD0CgYEApTSoPjdIGWhsnuxxn05hQCoqFAAyDHm7qWm1
+zeZ1l6sBNsrzThrAfJq89vnJHwyIUUMSUWNmNPtXtlwnd4DX9fvIam1P0OSpQ+fR
+fhkWuCTzRV5TLfcZpcV3Bop6u7eto16bXgzwP1sbSTy65MemJEY1ip6rVFHZ4iCg
+TeAVwQECgYA77IinbIXBvKXi1JrTnZCpEAKW7sqVJFmJg3PVrMT3nMo92pNCSWtV
+yl5G8WWE70tOJciN4egWoOOzhIF7vWn4QTIb/sQab6cWm1PCU9qiNB8XxHyI8N3+
+Oi/G54Jt3koryin2xTnaTaha5ygn+ZnHV3Lb39rHN9Cln/q1qGFcwg==
+-----END RSA PRIVATE KEY-----

src/code.cloudfoundry.org/inigo/fixtures/regenerate-certs.sh

@@ -43,4 +43,15 @@ mv -f out/localhost.key ./certs/sql-certs/server.key
 mv -f out/* ./certs/sql-certs
 rm -rf out
 
+# ./nats/* certs: nats-server (TLS, client verification) and its clients (gorouter, route-emitter)
+mkdir -p ./certs/nats
+certstrap init --common-name "nats-ca" --passphrase ""
+certstrap request-cert --common-name "nats_server" --domain "nats_server" --ip "127.0.0.1" --passphrase ""
+certstrap sign nats_server --CA "nats-ca"
+certstrap request-cert --common-name "client" --domain "client" --passphrase ""
+certstrap sign client --CA "nats-ca"
+
+mv -f out/* ./certs/nats
+rm -rf out
+
 popd

src/code.cloudfoundry.org/inigo/world/components.go

@@ -246,6 +246,15 @@ func makeCommonComponentMaker(builtArtifacts BuiltArtifacts, worldAddresses Comp
 		CACert:     caCert,
 	}
 
+	natsCertsDir := filepath.Join("..", "fixtures", "certs", "nats")
+	natsSSLConfig := SSLConfig{
+		ServerCert: filepath.Join(natsCertsDir, "nats_server.crt"),
+		ServerKey:  filepath.Join(natsCertsDir, "nats_server.key"),
+		ClientCert: filepath.Join(natsCertsDir, "client.crt"),
+		ClientKey:  filepath.Join(natsCertsDir, "client.key"),
+		CACert:     filepath.Join(natsCertsDir, "nats-ca.crt"),
+	}
+
 	locketSSLConfig := SSLConfig{
 		ServerCert: bbsServerCert,
 		ServerKey:  bbsServerKey,
@@ -327,6 +336,7 @@ func makeCommonComponentMaker(builtArtifacts BuiltArtifacts, worldAddresses Comp
 		gardenConfig:           gardenConfig,
 		sshConfig:              sshKeys,
 		bbsSSL:                 bbsSSLConfig,
+		natsSSL:                natsSSLConfig,
 		locketSSL:              locketSSLConfig,
 		repSSL:                 repSSLConfig,
 		auctioneerSSL:          auctioneerSSLConfig,
@@ -396,6 +406,7 @@ type commonComponentMaker struct {
 	gardenConfig           GardenSettingsConfig
 	sshConfig              SSHKeys
 	bbsSSL                 SSLConfig
+	natsSSL                SSLConfig
 	locketSSL              SSLConfig
 	repSSL                 SSLConfig
 	auctioneerSSL          SSLConfig
@@ -474,6 +485,11 @@ func (maker commonComponentMaker) NATS(argv ...string) ifrit.Runner {
 			append([]string{
 				"--addr", host,
 				"--port", port,
+				"--tls",
+				"--tlscert", maker.natsSSL.ServerCert,
+				"--tlskey", maker.natsSSL.ServerKey,
+				"--tlscacert", maker.natsSSL.CACert,
+				"--tlsverify",
 			}, argv...)...,
 		),
 	})
@@ -785,6 +801,10 @@ func (maker commonComponentMaker) RouteEmitterN(n int, fs ...func(config *routee
 		LockTTL:                      durationjson.Duration(locket.DefaultSessionTTL),
 		NATSUsername:                 "nats",
 		NATSPassword:                 "nats",
+		NATSTLSEnabled:               true,
+		NATSCACertFile:               maker.natsSSL.CACert,
+		NATSClientCertFile:           maker.natsSSL.ClientCert,
+		NATSClientKeyFile:            maker.natsSSL.ClientKey,
 		RouteEmittingWorkers:         20,
 		SyncInterval:                 durationjson.Duration(time.Minute),
 		TCPRouteTTL:                  durationjson.Duration(2 * time.Minute),
@@ -896,6 +916,19 @@ func (maker commonComponentMaker) FileServer(modifyConfigFuncs ...func(*fileserv
 	}), servedFilesDir
 }
 
+// indentedFileContents returns the file's contents indented for embedding in a
+// YAML block scalar nested two levels deep.
+func indentedFileContents(path string) string {
+	contents, err := os.ReadFile(path)
+	Expect(err).NotTo(HaveOccurred())
+
+	lines := strings.Split(strings.TrimSpace(string(contents)), "\n")
+	for i, line := range lines {
+		lines[i] = "    " + line
+	}
+	return strings.Join(lines, "\n")
+}
+
 func (maker commonComponentMaker) Router() *ginkgomon.Runner {
 	_, routerPort, err := net.SplitHostPort(maker.addresses.Router)
 	Expect(err).NotTo(HaveOccurred())
@@ -939,6 +972,13 @@ nats:
     port: %d
   user: ""
   pass: ""
+  tls_enabled: true
+  ca_certs: |
+%s
+  cert_chain: |
+%s
+  private_key: |
+%s
 logging:
   file: /dev/stdout
   syslog: ""
@@ -1001,7 +1041,14 @@ token_fetcher_retry_interval: 0s
 token_fetcher_expiration_buffer_time: 0
 pid_file: ""
 `
-	routerConfig = fmt.Sprintf(routerConfig, uint16(routerStatusPortInt), uint16(routerRoutesPortInt), natsHost, uint16(natsPortInt), uint16(routerPortInt), uint16(routerRouteServicesPortInt))
+	routerConfig = fmt.Sprintf(routerConfig,
+		uint16(routerStatusPortInt), uint16(routerRoutesPortInt),
+		natsHost, uint16(natsPortInt),
+		indentedFileContents(maker.natsSSL.CACert),
+		indentedFileContents(maker.natsSSL.ClientCert),
+		indentedFileContents(maker.natsSSL.ClientKey),
+		uint16(routerPortInt), uint16(routerRouteServicesPortInt),
+	)
 
 	configFile, err := os.CreateTemp(TempDirWithParent(maker.tmpDir, "router-config"), "router-config")
 	Expect(err).NotTo(HaveOccurred())