TLS-enabled connections with a self signed certificate fail #2440
-
|
Hi , Following are my configurations used rabbitmq.config keys were generated using the following commands My node application code is and the response is Tried with openssl connect and got error of 54 My spring config is as follows And the error stack trace was Can I know where exactly I am going wrong ? or is it that rabbitmq does not support self signed certificates? |
Beta Was this translation helpful? Give feedback.
Answered by
michaelklishin
Sep 4, 2020
Replies: 13 comments 7 replies
-
|
It's not clear from your code what port you are trying to use. You haven't posted any RabbitMQ log snippets either. The message simply says that a TCP socket was closed, it can be that the client tries to use port 5672 (which does not expect a TLS upgrade and will close any connection that does not initiate an AMQP 0-9-1 or AMQP 1.0 handshake). It could be something else. Troubleshooting TLS provides a framework for narrowing the issue down. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
RabbitMQ does support self-signed certificates, as the TLS guide explains. Or rather, it does not care whether the certificates in the chain are self-signed or not, they just have to be trusted on the host. We have a project that generates self-signed certificate chains. You can use it to compare. We always recommend starting with the most permissive set of TLS versions enabled (same goes for cipher suites) and then narrowing them down. Your example goes straight to TLSv1.2-only. There are threads on the Internet that show that incompatible version lists or tools will lead to exactly the same "failed write" As a side note, all TLS settings you use can be configured using You also configure RabbitMQ to verify clients. Consider first making things work without peer verification, then add server verification for clients, then mutual if needed. Again, the idea is to start with the most basic setup and add d restrictions after it succeeds. |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
tried with rabbitmq.conf and faced the same issue. Following is my conf I am still getting the same error ECONNRESET |
Beta Was this translation helpful? Give feedback.
-
makes me wonder if this config file of yours is even used at all. Relevan doc guides:
but these are just wild guesses because we don't have any server logs to work with. When in doubt, first see if there's anything in the server logs, e.g. can the node actually load the certificate key/pair on start? What is logged during a client connection attempt, and so on. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Hi , Following is my rabbitmq log , and there is no log entry when a request is made. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
My rabbitmq status is here |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
tried using the keys generated by tls-gen, and i am getting the same error of ECONNRESET in node js and write:errno=54 with openssl s_client. Is there any place we can enable specific logs for these ? |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
@revoorunischal ECONNREST is a TCP-level "connection refused" message. A TLS connection upgrade happens after a successful TCP connection. If no requests are logged, your issue is elsewhere (could be a MacOS firewall, for example). Wireshark is the best source of information on what is really going on with a connection. |
Beta Was this translation helpful? Give feedback.
-
|
Hi , Now the issue what is occurring is peer verification is not happening from rabbitmq. Client is able to verify the server but server fails to verify the client and getting an error in readhandshake (Caused by: javax.net.ssl.SSLException: readHandshakeRecord). By removing verify_peer config (ssl_options.verify = verify_peer) makes the connection working but now 2 way ssl is not complete, right ??. Else if fail_if_no_peer_cert is set to false( ssl_options.fail_if_no_peer_cert = false) and i provide a key which is not truststore connection completes, but again 2 way ssl is not complete. I have added all my keys, commands used , sample java project and rabbitmq.conf in a github project for you to reproduce in github Following are the error logs And following is the stacktrace in java |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
@revoorunischal according to some findings, this is due to a TLS version mismatch. The stack trace mentions For ECC suites, the latest Erlang release and a reasonably recent JDK are always recommended. There are explicit and implicit limitations in order TLS implementations of various ECC suites. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
There are several things about this example that make reproducing the issue more time consuming. I can successfully connect with
Once I concatenated the CA files into one: and add a password to the config file: log.file.level = debug
listeners.ssl.default = 5671
ssl_options.cacertfile = /tmp/rabbitmqssltest/keys2/ca_bundle.pem
ssl_options.certfile = /tmp/rabbitmqssltest/keys2/rabbit-public.pem
ssl_options.keyfile = /tmp/rabbitmqssltest/keys2/rabbit-private.pem
ssl_options.password = prat123
# ssl_options.verify = verify_peer
# ssl_options.fail_if_no_peer_cert = trueI was able to connect (note the server certificate information; RabbitMQ also logged a AMQP 0-9-1/1.0 handshake timeout, which means TLS upgrade has succeeded): |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
With enabled peer verification, I don't have much recent experience with I'd recommend taking the Dropping private key passwords initially is also a good idea. |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
"alert 42" or "bad certificate" can mean a broad range of problems but in general, it means that a peer certificate did not satisfy some conditions. I could reproduce the exception from |
Beta Was this translation helpful? Give feedback.
-
|
Using I'll skip the steps where I created an empty trust store file with and updating the Boot config file to match: logging.level.root: DEBUG
spring:
cloud:
stream:
bindings:
input:
destination: queue.log.messages
binder: local_rabbit
output:
destination: queue.pretty.log.messages
binder: local_rabbit
binders:
local_rabbit:
type: rabbit
environment:
spring:
rabbitmq:
addresses: amqps://guest:guest@localhost:5671
virtual-host: /
ssl:
enabled: true
key-store: file:/tmp/rabbitmqssltest/keys3/client_key.p12
key-store-password: bunnies
trust-store: file:/tmp/rabbitmqssltest/keys3/truststore.jks
trust-store-password: bunnies
verify-hostname: true
validate-server-certificate: trueI managed to successfully connect: rabbitmqctl list_connections user peer_host peer_port state ssl --formatter=pretty_table
# => Listing connections ...
# => ┌───────┬───────────────────────────┬───────────┬─────────┬──────┐
# => │ user │ peer_host │ peer_port │ state │ ssl │
# => ├───────┼───────────────────────────┼───────────┼─────────┼──────┤
# => │ guest │ {0,0,0,0,0,65535,32512,1} │ 63094 │ running │ true │
# => └───────┴───────────────────────────┴───────────┴─────────┴──────┘ |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
This connection uses TLSv1.2 with an ECC suite:
I am running this Boot app on JDK 13. |
Beta Was this translation helpful? Give feedback.
Answer selected by
michaelklishin
-
|
If you compare your "iot" (client) certificate with that produced by you will notice that they have different x509v3 extensions. Those extensions are critically important as they can prevent certificates from being used for certain purposes. These are highly relevant for data service clients, including RabbitMQ Your certificate only has a subject key identifier extension: The same goes for the server certificate: So indeed the certificate generation process with |
Beta Was this translation helpful? Give feedback.
2 replies
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
oh i could work with these keys itself using truststore. |
Beta Was this translation helpful? Give feedback.
-
|
Hi , After seeing the issue raised here #2405. I realised even I have to do the same so I also added a empty.pem in cacerts and then added truststore directory and added truststore plugin, after doing these it started working fine. Also as he mentions in his google thread the order matters truststore should come after cacerts else it doesn't work. But the other issue is after adding truststore plugin I am not able to start rabbitmq using brew services. Its crashing with erlang exceptions. I have attached here the entire log folder zip tar (https://drive.google.com/file/d/1J4rIuyb08KvB1c7hikhOfnWBctTf6wYQ/view?usp=sharing) and error snippet is |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
@revoorunischal you should mention the exact configuration you use since we had no idea that the trust store plugin was involved. We strongly prefer to have one question per discussion in this community. |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Using
tls-gen's basic profile, and importingca_certificate.pem,client_certificate.pem,server_certificate.peminto a JDK trust store like so: