diff --git a/.goreleaser.yml b/.goreleaser.yml
new file mode 100644
index 00000000..01f06bc0
--- /dev/null
+++ b/.goreleaser.yml
@@ -0,0 +1,58 @@
+project_name: nats-server
+
+release:
+  github:
+    owner: nats-io
+    name: nats-server
+  name_template: 'Release {{.Tag}}'
+  draft: true
+
+changelog:
+  skip: true
+
+builds:
+- main: ./main.go
+  binary: nats-server
+  ldflags:
+    - -s -w -X github.com/nats-io/nats-server/server.gitCommit={{.ShortCommit}}
+  env:
+    - GO111MODULE=off
+    - CGO_ENABLED=0
+  goos:
+  - darwin
+  - linux
+  - windows
+  goarch:
+  - amd64
+  - arm
+  - arm64
+  - 386
+  goarm:
+  - 6
+  - 7
+  ignore:
+    - goos: darwin
+      goarch: 386
+
+nfpms:
+  - name_template: '{{.ProjectName}}-{{.Tag}}-{{.Arch}}{{if .Arm}}{{.Arm}}{{end}}'
+    homepage:  https://nats.io
+    description: High-Performance server for NATS, the cloud native messaging system.
+    maintainer: Ivan Kozlovic <ivan@synadia.com>
+    license: Apache 2.0
+    vendor: Synadia Inc.
+    formats:
+    - deb
+    - rpm
+
+archives:
+  - name_template: '{{.ProjectName}}-{{.Tag}}-{{.Os}}-{{.Arch}}{{if .Arm}}{{.Arm}}{{end}}'
+    wrap_in_directory: true
+    format: zip
+    files:
+      - README.md
+      - LICENSE
+
+checksum:
+  name_template: 'SHA256SUMS'
+  algorithm: sha256
diff --git a/.travis.yml b/.travis.yml
index 5517e5bc..00bdced3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,6 +2,10 @@ language: go
 go:
 - 1.11.x
 - 1.12.x
+addons:
+  apt:
+    packages:
+    - rpm
 env:
 - GO111MODULE=off
 go_import_path: github.com/nats-io/nats-server
@@ -9,9 +13,6 @@ install:
 - go get github.com/nats-io/nats.go/
 - go get github.com/nats-io/nkeys
 - go get github.com/nats-io/jwt
-- go get github.com/mattn/goveralls
-- go get github.com/wadey/gocovmerge
-- go get github.com/tcnksm/ghr
 - go get -u honnef.co/go/tools/cmd/staticcheck
 - go get -u github.com/client9/misspell/cmd/misspell
 before_script:
@@ -21,11 +22,19 @@ before_script:
 - go vet $EXCLUDE_VENDOR
 - misspell -error -locale US $EXCLUDE_VENDOR
 - staticcheck $EXCLUDE_VENDOR
-- if [[ "$TRAVIS_GO_VERSION" =~ 1.11 ]] && [ "$TRAVIS_TAG" != "" ]; then ./scripts/cross_compile.sh $TRAVIS_TAG; fi
 script:
 - go test -i $EXCLUDE_VENDOR
 - go test -run=TestNoRace $EXCLUDE_VENDOR
-- GOGC=10 go test -v -race -p=1 --failfast $EXCLUDE_VENDOR
-# - if [[ "$TRAVIS_GO_VERSION" =~ 1.11 ]]; then ./scripts/cov.sh TRAVIS; else GOGC=10 go test -v -race -p=1 --failfast $EXCLUDE_VENDOR; fi
-after_success:
-- if [[ "$TRAVIS_GO_VERSION" =~ 1.11 ]] && [ "$TRAVIS_TAG" != "" ]; then ghr --owner nats-io --token $GITHUB_TOKEN --draft --replace $TRAVIS_TAG pkg/; fi
+- if [[ "$TRAVIS_GO_VERSION" =~ 1.12 ]]; then ./scripts/cov.sh TRAVIS; else go test -v -race -p=1 --failfast $EXCLUDE_VENDOR; fi
+
+deploy:
+  provider: script
+  skip_cleanup: true
+  script: curl -sL http://git.io/goreleaser | bash
+  verbose: true
+  on:
+    tags: true
+    condition: $TRAVIS_GO_VERSION =~ 1.12
+
+notifications:
+  email: false
diff --git a/Dockerfile b/Dockerfile
index a251f168..207f168d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.11.12
+FROM golang:1.12.8
 
 MAINTAINER Ivan Kozlovic <ivan@synadia.com>
 
diff --git a/Dockerfile.all b/Dockerfile.all
index 16ba2928..e799e5d8 100644
--- a/Dockerfile.all
+++ b/Dockerfile.all
@@ -1,4 +1,4 @@
-FROM golang:1.11.12
+FROM golang:1.12.8
 
 MAINTAINER Ivan Kozlovic <ivan@synadia.com>
 
diff --git a/README.md b/README.md
index 450e3867..629bc6ea 100644
--- a/README.md
+++ b/README.md
@@ -29,8 +29,8 @@ If you are interested in contributing to NATS, read about our...
 [Fossa-Image]: https://app.fossa.io/api/projects/git%2Bgithub.com%2Fnats-io%2Fgnatsd.svg?type=shield
 [Build-Status-Url]: https://travis-ci.org/nats-io/nats-server
 [Build-Status-Image]: https://travis-ci.org/nats-io/nats-server.svg?branch=master
-[Release-Url]: https://github.com/nats-io/nats-server/releases/tag/v2.0.2
-[Release-image]: https://img.shields.io/badge/release-v2.0.2-1eb0fc.svg
+[Release-Url]: https://github.com/nats-io/nats-server/releases/tag/v2.0.4
+[Release-image]: https://img.shields.io/badge/release-v2.0.4-1eb0fc.svg
 [Coverage-Url]: https://coveralls.io/r/nats-io/nats-server?branch=master
 [Coverage-image]: https://coveralls.io/repos/github/nats-io/nats-server/badge.svg?branch=master
 [ReportCard-Url]: https://goreportcard.com/report/nats-io/nats-server
diff --git a/go.mod b/go.mod
index f19fbed0..31dcb5c2 100644
--- a/go.mod
+++ b/go.mod
@@ -1,7 +1,7 @@
 module github.com/nats-io/nats-server/v2
 
 require (
-	github.com/nats-io/jwt v0.2.13-0.20190807221443-88776a07123f
+	github.com/nats-io/jwt v0.2.14
 	github.com/nats-io/nats.go v1.8.1
 	github.com/nats-io/nkeys v0.1.0
 	github.com/nats-io/nuid v1.0.1
diff --git a/go.sum b/go.sum
index a651b7f1..dfab468e 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,5 @@
-github.com/nats-io/jwt v0.2.13-0.20190726194050-829b612a49c3 h1:5vVSRJhjWOTv/TeJX1NUGuDYbZkfcWTu/97AHlsC02o=
-github.com/nats-io/jwt v0.2.13-0.20190726194050-829b612a49c3/go.mod h1:mQxQ0uHQ9FhEVPIcTSKwx2lqZEpXWWcCgA7R6NrWvvY=
-github.com/nats-io/jwt v0.2.13-0.20190807221443-88776a07123f h1:HXbsDIrce5ay5anz4HAI57VYDcGznOYs0hCj2QZXBzI=
-github.com/nats-io/jwt v0.2.13-0.20190807221443-88776a07123f/go.mod h1:mQxQ0uHQ9FhEVPIcTSKwx2lqZEpXWWcCgA7R6NrWvvY=
+github.com/nats-io/jwt v0.2.14 h1:wA50KvFz/JXGXMHRygTWsRGh/ixxgC5E3kHvmtGLNf4=
+github.com/nats-io/jwt v0.2.14/go.mod h1:fRYCDE99xlTsqUzISS1Bi75UBJ6ljOJQOAAu5VglpSg=
 github.com/nats-io/nats.go v1.8.1 h1:6lF/f1/NN6kzUDBz6pyvQDEXO39jqXcWRLu/tKjtOUQ=
 github.com/nats-io/nats.go v1.8.1/go.mod h1:BrFz9vVn0fU3AcH9Vn4Kd7W0NpJ651tD5omQ3M8LwxM=
 github.com/nats-io/nkeys v0.0.2/go.mod h1:dab7URMsZm6Z/jp9Z5UGa87Uutgc2mVpXLC4B7TDb/4=
diff --git a/scripts/cov.sh b/scripts/cov.sh
index 0d09aae2..8aee159b 100755
--- a/scripts/cov.sh
+++ b/scripts/cov.sh
@@ -1,12 +1,17 @@
 #!/bin/bash -e
 # Run from directory above via ./scripts/cov.sh
 
+export GO111MODULE="off"
+
+go get github.com/mattn/goveralls
+go get github.com/wadey/gocovmerge
+
 rm -rf ./cov
 mkdir cov
-go test -v -covermode=atomic -coverprofile=./cov/conf.out ./conf
-go test -v -covermode=atomic -coverprofile=./cov/log.out ./logger
-go test -v -covermode=atomic -coverprofile=./cov/server.out  --failfast ./server
-go test -v -covermode=atomic -coverprofile=./cov/test.out -coverpkg=./server  --failfast ./test
+go test -v -failfast -covermode=atomic -coverprofile=./cov/conf.out ./conf
+go test -v -failfast -covermode=atomic -coverprofile=./cov/log.out ./logger
+go test -v -failfast -covermode=atomic -coverprofile=./cov/server.out ./server
+go test -v -failfast -covermode=atomic -coverprofile=./cov/test.out -coverpkg=./server ./test
 gocovmerge ./cov/*.out > acc.out
 rm -rf ./cov
 
diff --git a/scripts/cross_compile.sh b/scripts/cross_compile.sh
deleted file mode 100755
index c2779822..00000000
--- a/scripts/cross_compile.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/bash
-set -e
-
-# For now depend on vendor directory.
-# When we change to modules we need this to force pull in windows.
-# GOOS=windows GOARCH=amd64 go get -u
-export GO111MODULE="off"
-
-go get github.com/mitchellh/gox
-
-export APPNAME="nats-server"
-export OSARCH="linux/386 linux/amd64 linux/arm64 darwin/amd64 windows/386 windows/amd64"
-export DIRS="linux-386 linux-amd64 linux-arm6 linux-arm7 linux-arm64 darwin-amd64 windows-386 windows-amd64"
-export OUTDIR="pkg"
-
-# If we have an arg, assume its a version tag and rename as appropriate.
-if [[ -n $1 ]]; then
-    export APPNAME=$APPNAME-$1
-fi
-
-# Build all from OSARCH list
-env CGO_ENABLED=0 gox -osarch="$OSARCH" -ldflags="-s -w" -output "$OUTDIR/$APPNAME-{{.OS}}-{{.Arch}}/nats-server"
-
-# Be explicit about the ARM builds
-# ARMv6
-env CGO_ENABLED=0 GOARM=6 gox -osarch="linux/arm" -ldflags="-s -w" -output "$OUTDIR/$APPNAME-linux-arm6/nats-server"
-# ARMv7
-env CGO_ENABLED=0 GOARM=7 gox -osarch="linux/arm" -ldflags="-s -w" -output "$OUTDIR/$APPNAME-linux-arm7/nats-server"
-
-# Create the zip files
-for dir in $DIRS; do \
-    (cp README.md $OUTDIR/$APPNAME-$dir/README.md) ;\
-    (cp LICENSE $OUTDIR/$APPNAME-$dir/LICENSE) ;\
-    (cd $OUTDIR && zip -q $APPNAME-$dir.zip -r $APPNAME-$dir) ;\
-    echo "make $OUTDIR/$APPNAME-$dir.zip" ;\
-done
diff --git a/server/norace_test.go b/server/norace_test.go
index 870d7214..460bbed1 100644
--- a/server/norace_test.go
+++ b/server/norace_test.go
@@ -692,7 +692,7 @@ func TestNoRaceRouteCache(t *testing.T) {
 
 			checkExpected := func(t *testing.T, expected int) {
 				t.Helper()
-				checkFor(t, time.Second, 15*time.Millisecond, func() error {
+				checkFor(t, 2*time.Second, 15*time.Millisecond, func() error {
 					route.mu.Lock()
 					n := len(route.in.pacache)
 					route.mu.Unlock()
diff --git a/test/new_routes_test.go b/test/new_routes_test.go
index 8231ab48..07129efb 100644
--- a/test/new_routes_test.go
+++ b/test/new_routes_test.go
@@ -18,9 +18,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"net"
-	"net/url"
-	"runtime"
-	"strconv"
 	"sync"
 	"testing"
 	"time"
@@ -1605,57 +1602,6 @@ func TestNewRouteLargeDistinctQueueSubscribers(t *testing.T) {
 	})
 }
 
-func TestLargeClusterMem(t *testing.T) {
-	// Try to clean up.
-	runtime.GC()
-	var m runtime.MemStats
-	runtime.ReadMemStats(&m)
-	pta := m.TotalAlloc
-
-	opts := func() *server.Options {
-		o := DefaultTestOptions
-		o.Host = "127.0.0.1"
-		o.Port = -1
-		o.Cluster.Host = o.Host
-		o.Cluster.Port = -1
-		return &o
-	}
-
-	var servers []*server.Server
-
-	// Create seed first.
-	o := opts()
-	s := RunServer(o)
-	servers = append(servers, s)
-
-	// For connecting to seed server above.
-	routeAddr := fmt.Sprintf("nats-route://%s:%d", o.Cluster.Host, o.Cluster.Port)
-	rurl, _ := url.Parse(routeAddr)
-	routes := []*url.URL{rurl}
-
-	numServers := 15
-
-	for i := 1; i < numServers; i++ {
-		o := opts()
-		o.Routes = routes
-		s := RunServer(o)
-		servers = append(servers, s)
-	}
-	checkClusterFormed(t, servers...)
-
-	// Calculate in MB what we are using now.
-	const max = 50 * 1024 * 1024 // 50MB
-	runtime.ReadMemStats(&m)
-	used := m.TotalAlloc - pta
-	if used > max {
-		t.Fatalf("Cluster using too much memory, expect < 50MB, got %dMB", used/(1024*1024))
-	}
-
-	for _, s := range servers {
-		s.Shutdown()
-	}
-}
-
 func TestClusterLeaksSubscriptions(t *testing.T) {
 	srvA, srvB, optsA, optsB := runServers(t)
 	defer srvA.Shutdown()
@@ -1776,76 +1722,3 @@ func TestClusterLeaksSubscriptions(t *testing.T) {
 		return nil
 	})
 }
-
-// Make sure we have the correct remote state when dealing with queue subscribers
-// across many client connections.
-func TestQueueSubWeightOrderMultipleConnections(t *testing.T) {
-	s, opts := runNewRouteServer(t)
-	defer s.Shutdown()
-
-	// Create 100 connections to s
-	url := fmt.Sprintf("nats://%s:%d", opts.Host, opts.Port)
-	clients := make([]*nats.Conn, 0, 100)
-	for i := 0; i < 100; i++ {
-		nc, err := nats.Connect(url, nats.NoReconnect())
-		if err != nil {
-			t.Fatalf("Error connecting: %v", err)
-		}
-		defer nc.Close()
-		clients = append(clients, nc)
-	}
-
-	rc := createRouteConn(t, opts.Cluster.Host, opts.Cluster.Port)
-	defer rc.Close()
-
-	routeID := "RTEST_NEW:22"
-	routeSend, routeExpect := setupRouteEx(t, rc, opts, routeID)
-
-	info := checkInfoMsg(t, rc)
-
-	info.ID = routeID
-	b, err := json.Marshal(info)
-	if err != nil {
-		t.Fatalf("Could not marshal test route info: %v", err)
-	}
-	routeSend(fmt.Sprintf("INFO %s\r\n", b))
-
-	start := make(chan bool)
-	for _, nc := range clients {
-		go func(nc *nats.Conn) {
-			<-start
-			// Now create 100 identical queue subscribers on each connection.
-			for i := 0; i < 100; i++ {
-				if _, err := nc.QueueSubscribeSync("foo", "bar"); err != nil {
-					return
-				}
-			}
-			nc.Flush()
-		}(nc)
-	}
-	close(start)
-
-	// We did have this where we wanted to get every update, but now with optimizations
-	// we just want to make sure we always are increasing and that a previous update to
-	// a lesser queue weight is never delivered for this test.
-	max_expected := 10000
-	for qw := 0; qw < max_expected; {
-		buf := routeExpect(rsubRe)
-		matches := rsubRe.FindAllSubmatch(buf, -1)
-		for _, m := range matches {
-			if len(m) != 5 {
-				t.Fatalf("Expected a weight for the queue group")
-			}
-			nqw, err := strconv.Atoi(string(m[4]))
-			if err != nil {
-				t.Fatalf("Got an error converting queue weight: %v", err)
-			}
-			// Make sure the new value only increases, ok to skip since we will
-			// optimize this now, but needs to always be increasing.
-			if nqw <= qw {
-				t.Fatalf("Was expecting increasing queue weight after %d, got %d", qw, nqw)
-			}
-			qw = nqw
-		}
-	}
-}
diff --git a/test/norace_test.go b/test/norace_test.go
index 413ff40c..d194301d 100644
--- a/test/norace_test.go
+++ b/test/norace_test.go
@@ -16,15 +16,21 @@
 package test
 
 import (
+	"encoding/json"
 	"fmt"
 	"io/ioutil"
 	"net"
+	"net/url"
 	"os"
 	"regexp"
 	"runtime"
+	"strconv"
 	"sync"
 	"testing"
 	"time"
+
+	"github.com/nats-io/nats-server/v2/server"
+	"github.com/nats-io/nats.go"
 )
 
 // IMPORTANT: Tests in this file are not executed when running with the -race flag.
@@ -270,3 +276,127 @@ func TestNoRaceDynamicResponsePermsMemory(t *testing.T) {
 		return nil
 	})
 }
+
+func TestNoRaceLargeClusterMem(t *testing.T) {
+	// Try to clean up.
+	runtime.GC()
+	var m runtime.MemStats
+	runtime.ReadMemStats(&m)
+	pta := m.TotalAlloc
+
+	opts := func() *server.Options {
+		o := DefaultTestOptions
+		o.Host = "127.0.0.1"
+		o.Port = -1
+		o.Cluster.Host = o.Host
+		o.Cluster.Port = -1
+		return &o
+	}
+
+	var servers []*server.Server
+
+	// Create seed first.
+	o := opts()
+	s := RunServer(o)
+	servers = append(servers, s)
+
+	// For connecting to seed server above.
+	routeAddr := fmt.Sprintf("nats-route://%s:%d", o.Cluster.Host, o.Cluster.Port)
+	rurl, _ := url.Parse(routeAddr)
+	routes := []*url.URL{rurl}
+
+	numServers := 15
+
+	for i := 1; i < numServers; i++ {
+		o := opts()
+		o.Routes = routes
+		s := RunServer(o)
+		servers = append(servers, s)
+	}
+	checkClusterFormed(t, servers...)
+
+	// Calculate in MB what we are using now.
+	const max = 50 * 1024 * 1024 // 50MB
+	runtime.ReadMemStats(&m)
+	used := m.TotalAlloc - pta
+	if used > max {
+		t.Fatalf("Cluster using too much memory, expect < 50MB, got %dMB", used/(1024*1024))
+	}
+
+	for _, s := range servers {
+		s.Shutdown()
+	}
+}
+
+// Make sure we have the correct remote state when dealing with queue subscribers
+// across many client connections.
+func TestQueueSubWeightOrderMultipleConnections(t *testing.T) {
+	s, opts := runNewRouteServer(t)
+	defer s.Shutdown()
+
+	// Create 100 connections to s
+	url := fmt.Sprintf("nats://%s:%d", opts.Host, opts.Port)
+	clients := make([]*nats.Conn, 0, 100)
+	for i := 0; i < 100; i++ {
+		nc, err := nats.Connect(url, nats.NoReconnect())
+		if err != nil {
+			t.Fatalf("Error connecting: %v", err)
+		}
+		defer nc.Close()
+		clients = append(clients, nc)
+	}
+
+	rc := createRouteConn(t, opts.Cluster.Host, opts.Cluster.Port)
+	defer rc.Close()
+
+	routeID := "RTEST_NEW:22"
+	routeSend, routeExpect := setupRouteEx(t, rc, opts, routeID)
+
+	info := checkInfoMsg(t, rc)
+
+	info.ID = routeID
+	b, err := json.Marshal(info)
+	if err != nil {
+		t.Fatalf("Could not marshal test route info: %v", err)
+	}
+	routeSend(fmt.Sprintf("INFO %s\r\n", b))
+
+	start := make(chan bool)
+	for _, nc := range clients {
+		go func(nc *nats.Conn) {
+			<-start
+			// Now create 100 identical queue subscribers on each connection.
+			for i := 0; i < 100; i++ {
+				if _, err := nc.QueueSubscribeSync("foo", "bar"); err != nil {
+					return
+				}
+			}
+			nc.Flush()
+		}(nc)
+	}
+	close(start)
+
+	// We did have this where we wanted to get every update, but now with optimizations
+	// we just want to make sure we always are increasing and that a previous update to
+	// a lesser queue weight is never delivered for this test.
+	maxExpected := 10000
+	for qw := 0; qw < maxExpected; {
+		buf := routeExpect(rsubRe)
+		matches := rsubRe.FindAllSubmatch(buf, -1)
+		for _, m := range matches {
+			if len(m) != 5 {
+				t.Fatalf("Expected a weight for the queue group")
+			}
+			nqw, err := strconv.Atoi(string(m[4]))
+			if err != nil {
+				t.Fatalf("Got an error converting queue weight: %v", err)
+			}
+			// Make sure the new value only increases, ok to skip since we will
+			// optimize this now, but needs to always be increasing.
+			if nqw <= qw {
+				t.Fatalf("Was expecting increasing queue weight after %d, got %d", qw, nqw)
+			}
+			qw = nqw
+		}
+	}
+}
diff --git a/test/tls_test.go b/test/tls_test.go
index 1269e855..43727bc3 100644
--- a/test/tls_test.go
+++ b/test/tls_test.go
@@ -548,28 +548,13 @@ func TestTLSRoutesCertificateCNBasedAuth(t *testing.T) {
 		t.Error("Expected Cluster TLS verify and map feature to be activated")
 	}
 
-	routeA, err := url.Parse("nats://localhost:9935")
-	if err != nil {
-		t.Fatal(err)
-	}
-	routeB, err := url.Parse("nats://localhost:9936")
-	if err != nil {
-		t.Fatal(err)
-	}
-	routeC, err := url.Parse("nats://localhost:9937")
-	if err != nil {
-		t.Fatal(err)
-	}
-	routes := make([]*url.URL, 3)
-	routes[0] = routeA
-	routes[1] = routeB
-	routes[2] = routeC
+	routeURLs := "nats://localhost:9935, nats://localhost:9936, nats://localhost:9937"
 
 	optsA.Host = "127.0.0.1"
 	optsA.Port = 9335
 	optsA.Cluster.Host = optsA.Host
 	optsA.Cluster.Port = 9935
-	optsA.Routes = routes
+	optsA.Routes = server.RoutesFromStr(routeURLs)
 	srvA := RunServer(optsA)
 	defer srvA.Shutdown()
 
@@ -577,7 +562,7 @@ func TestTLSRoutesCertificateCNBasedAuth(t *testing.T) {
 	optsB.Port = 9336
 	optsB.Cluster.Host = optsB.Host
 	optsB.Cluster.Port = 9936
-	optsB.Routes = routes
+	optsB.Routes = server.RoutesFromStr(routeURLs)
 	srvB := RunServer(optsB)
 	defer srvB.Shutdown()
 
@@ -585,10 +570,13 @@ func TestTLSRoutesCertificateCNBasedAuth(t *testing.T) {
 	optsC.Port = 9337
 	optsC.Cluster.Host = optsC.Host
 	optsC.Cluster.Port = 9937
-	optsC.Routes = routes
+	optsC.Routes = server.RoutesFromStr(routeURLs)
 	srvC := RunServer(optsC)
 	defer srvC.Shutdown()
 
+	// srvC is not connected to srvA and srvB due to wrong cert
+	checkClusterFormed(t, srvA, srvB)
+
 	nc1, err := nats.Connect(fmt.Sprintf("%s:%d", optsA.Host, optsA.Port), nats.Name("A"))
 	if err != nil {
 		t.Fatalf("Expected to connect, got %v", err)
@@ -619,8 +607,16 @@ func TestTLSRoutesCertificateCNBasedAuth(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	// This ensures that srvA has received the sub, not srvB
 	nc1.Flush()
 
+	checkFor(t, time.Second, 15*time.Millisecond, func() error {
+		if n := srvB.NumSubscriptions(); n != 1 {
+			return fmt.Errorf("Expected 1 sub, got %v", n)
+		}
+		return nil
+	})
+
 	// Not forwarded by cluster so won't be received.
 	err = nc2.Publish("private.foo", []byte("private message on server B"))
 	if err != nil {
@@ -720,6 +716,9 @@ func TestTLSGatewaysCertificateCNBasedAuth(t *testing.T) {
 	srvC := RunServer(optsC)
 	defer srvC.Shutdown()
 
+	waitForOutboundGateways(t, srvA, 1, 2*time.Second)
+	waitForOutboundGateways(t, srvB, 1, 2*time.Second)
+
 	nc1, err := nats.Connect(srvA.Addr().String(), nats.Name("A"))
 	if err != nil {
 		t.Fatalf("Expected to connect, got %v", err)
diff --git a/vendor/github.com/nats-io/jwt/go.mod b/vendor/github.com/nats-io/jwt/go.mod
index 2f3d42b1..b1ad180a 100644
--- a/vendor/github.com/nats-io/jwt/go.mod
+++ b/vendor/github.com/nats-io/jwt/go.mod
@@ -1,3 +1,3 @@
 module github.com/nats-io/jwt
 
-require github.com/nats-io/nkeys v0.0.2
+require github.com/nats-io/nkeys v0.1.0
diff --git a/vendor/github.com/nats-io/jwt/go.sum b/vendor/github.com/nats-io/jwt/go.sum
index 862d5938..ea493eca 100644
--- a/vendor/github.com/nats-io/jwt/go.sum
+++ b/vendor/github.com/nats-io/jwt/go.sum
@@ -1,6 +1,9 @@
-github.com/nats-io/nkeys v0.0.1 h1:D8diORXpjJEBxbDeeBtr4+drc4Ydzf4THJDVamDbd/g=
-github.com/nats-io/nkeys v0.0.1/go.mod h1:/5AG7AMgoe6jJRxS8l8qz974c6zxp5ApcV7VkXwSciY=
-github.com/nats-io/nkeys v0.0.2 h1:+qM7QpgXnvDDixitZtQUBDY9w/s9mu1ghS+JIbsrx6M=
-github.com/nats-io/nkeys v0.0.2/go.mod h1:dab7URMsZm6Z/jp9Z5UGa87Uutgc2mVpXLC4B7TDb/4=
-golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9 h1:mKdxBk7AujPs8kU4m80U72y/zjbZ3UcXC7dClwKbUI0=
-golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+github.com/nats-io/nkeys v0.1.0 h1:qMd4+pRHgdr1nAClu+2h/2a5F2TmKcCzjCDazVgRoX4=
+github.com/nats-io/nkeys v0.1.0/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4 h1:HuIa8hRrWRSrqYzx1qI49NNxhdi2PrY7gxVSq1JjLDc=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 20e32ba6..09c62e6d 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,4 +1,4 @@
-# github.com/nats-io/jwt v0.2.13-0.20190807221443-88776a07123f
+# github.com/nats-io/jwt v0.2.14
 github.com/nats-io/jwt
 # github.com/nats-io/nats.go v1.8.1
 github.com/nats-io/nats.go