-
Notifications
You must be signed in to change notification settings - Fork 55
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SSL configuration does not appear to work. #77
Comments
We have created an issue in Pivotal Tracker to manage this. Unfortunately, the Pivotal Tracker project is private so you may be unable to view the contents of the story. The labels on this github issue will be updated when the story is started. |
the ssl config we are trying to use:
|
Consider going through the TLS troubleshooting guide and posting actual log/error messages from both server and client ends. There can be perfectly legitimate reasons for TLS connections to fail even if everything is set up correctly as far as RabbitMQ is concerned: e.g. client certificate(s) are not trusted on the node. |
Hi @michaelklishin thanks for responding. I had been going through the troubleshooting guide earlier. Everything was working as expected, SSL listeners being started etcs, however I cannot connect via SSL with the RabbitMQ nodes (on AMQP+SSL). All the SSL errors were relating to SSL handshakes. When I get access to the logs ill post some extra detail in here. Has the latest release (v241) been tested with AMQP+SSL? I can't see anything obvious thats wrong in our config and it would very helpful to know if anyone else has it working so we can rule it out being a bug. |
@srbry you'd get a much more informed response if you post actual log entries from both sides plus To rule out any possible version-specific differences in behavior, simply deploy an older version and compare. |
@michaelklishin I fully intend to get the data. I haven't got access to the system to re-run the tests right now so I was simply trying to establish if there were any known issues (or common misconfigurations)/ working deployments on the latest version. |
@michaelklishin here are some more useful details. Startup logs
From the above I can see that we are starting SSL Listeners, I have enabled the SSL TestOpenssl
RabbitMQ logs
Nmap
|
Just for extra info, when running:
with
|
is definitely something to investigate, even though it's not very specific. Specifically I don't know what cipher suites this release may be forcing by default but it is something that the user can control. I am surprised to see
output by But it can be a red herring because the output against
but then the two negotiate to use
There are more threads for other Erlang-based projects that hint at cipher suite unavailability/mismatch. Consider trying with OTP 20.3 to compare. |
SSL definitely works in this release, my hunch is that it's a configuration issue. Will provide more details when a deployment with SSL completes successfully. |
Thanks @gerhard and @michaelklishin. I will also keep digging, I have currently configured rabbitmq to use all the ciphers that show up from I will give the switch a go. We are currently letting |
@michaelklishin @gerhard using |
@michaelklishin @gerhard I am not giving in on this one, its a bit of a strange one. After upgrading to OTP 20.3 I can now see the following message in the logs:
Its a bit strange considering they are read exactly the same using openssl.
|
@gerhard @michaelklishin Another update. If you generate the certs using |
I'm closing this issue as it seems like it's been resolved. There are numerous deployments of this release with TLS enabled so it seems very specific to your environment. Also, credhub is probably the best option anyway. |
When configuring the certs etc to enable SSL. It appears that SSL doesn't get properly enabled. After confirming certs/ ciphers etc are all valid using
openssl
we are still gettinghandshake
errors.It sounds like we need to configure auth_mechanisms to "External" to allow SSL auth, but that option doesn't seem to be present in this release?
The text was updated successfully, but these errors were encountered: