How can we establish a TLS connection to RabbitMQ?

[sebastianlung]

We are able to produce messages via port 5672 (without tls connection)

As soon as we try port 5671, which has tls enabled we receive an error:
ERROR com.mathworks.messaging.MessageQueueHandler - Unable to set up Message Queue Channel
Caused by: com.rabbitmq.client.ShutdownSignalException: connection error

We could not find an option or configuration within the documentation to set up CA File (what we assume is the issue)
Can you help us with that? @maben-mw

[michaelklishin]

The broker setup document mentions "TLS" or "SSL" just once, incorrectly referring the user to the Access Control guide for TLS docs. That guide technically does mention TLS in passing but it is not and never was the guide that covers setting up TLS, it simply mentions the possibility.

Guessing is a very expensive approach to troubleshooting distributed infrastructure. Team RabbitMQ has put together several troubleshooting guides and sections exactly so that there's less guessing in the community:

• Troubleshooting Netowrking
• Troubleshooting TLS
• Troubleshooting Authentication and Authorization

[michaelklishin]

This function that seems relevant suggests that this library does not configure any TLS-related settings on RabbitMQ Java client's ConnectionFactory.

Every other configuration related class adjacent to MessageQueueHandler suggests the same thing: this client simply does not expose any TLS-related settings, and does not propagate anything to the com.rabbitmq.client.ConnectionFactory it instantiates.

[maben-mw]

SSL/TLS is currently not supported in version 0.3.3 of the package. It should be possible however to add support for this. As @michaelklishin points out, the Java code should indeed be modified to configure the SSL context in the message queue connection factory and we will need to make this is all properly configurable through the configuration file and/or MATLAB classes.

Upon first glance the required changes should be straightforward enough but I will need a few days to implement and test this.

[michaelklishin]

@maben-mw I'd dare to say that most of the Java code in this library should be thrown away because it reinvents the parts that RabbitMQ Java client already provides, and instead this library should integrate with MathLab and give the user a way to use (well, specifically configure) RabbitMQ client's ConnectionFactory directly.

I mean that in the most positive way possible. It will make your and your users' life easier.

[maben-mw]

While it is probably true for the MATLAB as RabbitMQ Client part of this package that (most of the) intermediate Java code is not really necessary and it is likely possible to more directly interact with the RabbitMQ Java SDK from MATLAB; this is not true for the MATLAB Production Server MessageBroker part. The MessageBroker part is a Java application itself and the Java code in this repo is its source code.

As a matter of fact this package started with the standalone MessageBroker Java application and the MATLAB interface was added later. Where we then chose to reuse part of the MessageBroker Java code in the MATLAB interface, e.g. to easily allow both interfaces use the same YAML-(style) configuration files. Is this the most flexible option for the MATLAB interface part? Probably not, but it is important to remember, that the MATLAB interface is not the only part of this package.

Perhaps this will change in the future and the parts may be split up (further) but there currently are no concrete plans for this.

Note by-the-way that I do plan to add the SSL support to both parts of the package.

[michaelklishin]

I was only referring to the parts that reinvent the existing connection infrastructure in the Java client.

[maben-mw]

SSL/TLS support should now be available in version v0.5.0. Additional configuration options were added to both the configuration file (under sslcontext) as well as the MATLAB interface (through the sslcontext property); see the relevant sections in the updated configuration:

• https://mathworks-ref-arch.github.io/matlab-rabbitmq/MATLABInterface.html
• https://mathworks-ref-arch.github.io/matlab-rabbitmq/MessageBroker.html
• https://mathworks-ref-arch.github.io/matlab-rabbitmq/SSLTLS.html

[michaelklishin]

@maben-mw on behalf of the RabbitMQ core team, thank you!