self signed certificate between main node and leaf node?

[static-moonlight]

I have 2 nats servers running:

nats (leaf node) -> nats-hub (main node)

To better mimic production, I want to setup a TLS connection in my testing environment, using a self-signed certificate. When I do, the nats-hub is reporting this:

TLS handshake error: remote error: tls: bad certificate

this is the tls part of my NATS config (main node):

tls {
  cert_file: "/etc/nats/crt.pem"
  key_file: "/etc/nats/key.pem"
  insecure: true
}

I also tried with or without the insecure: true config, different combinations on both ends. No success though. Can somebody give me an example how to make NATS to accept my self-signed certificate?

And btw, why is the main node complaining about this? I had expected that the leaf node might have a problem with the certificate, offered by the main node. But that the main node iself is rejecting the certificate (as part if its config), actually surprised me.