By @JimmyWang6: prevent node from booting if credit_flow_default_credit is not valid

deps/rabbit/docs/rabbitmq.conf.example

@@ -12,8 +12,8 @@
 ##
 ## See https://www.rabbitmq.com/docs/documentation for the rest of RabbitMQ documentation.
 ##
-## In case you have questions, please use RabbitMQ community Slack and the rabbitmq-users Google group
-## instead of GitHub issues.
+## In case you have questions, please use rabbitmq/rabbitmq-server Discussions and the RabbitMQ community Discord server
+## for questions.
 
 # ======================================
 # Core broker section
@@ -374,6 +374,22 @@
 # tcp_listen_options.sndbuf = 196608
 # tcp_listen_options.recbuf = 196608
 
+##
+## Queues
+##
+
+## If set, the 'x-queue-type' header will be ignored (not compared for equivalence)
+## for queue redeclaration. This can simplify upgrades of applications that explicitly
+## set 'x-queue-type' to 'classic' for historical reasons but do not set any other
+## properties that may conflict or significantly change queue behavior and semantics, such as the 'exclusive' field.
+# quorum_queue.property_equivalence.relaxed_checks_on_redeclaration = true
+
+## Changes classic queue storage implementation version.
+## In 4.0.x, version 2 is the default and this is a forward compatibility setting,
+## that is, it will be useful when a new version is developed.
+##
+# classic_queue.default_version = 2
+
 ##
 ## Resource Limits & Flow Control
 ## ==============================

deps/rabbit/src/rabbit.erl

@@ -1751,10 +1751,26 @@ persist_static_configuration() ->
       [classic_queue_index_v2_segment_entry_count,
        classic_queue_store_v2_max_cache_size,
        classic_queue_store_v2_check_crc32,
-       incoming_message_interceptors,
-       credit_flow_default_credit
+       incoming_message_interceptors
       ]),
 
+    %% Disallow the following two cases:
+    %% 1. Negative values
+    %% 2. MoreCreditAfter greater than InitialCredit
+    CreditFlowDefaultCredit = case application:get_env(?MODULE, credit_flow_default_credit) of
+                     {ok, {InitialCredit, MoreCreditAfter}}
+                       when is_integer(InitialCredit) andalso
+                            is_integer(MoreCreditAfter) andalso
+                            InitialCredit > 0 andalso
+                            MoreCreditAfter > 0 andalso
+                            MoreCreditAfter < InitialCredit ->
+                         {InitialCredit, MoreCreditAfter};
+                     Other ->
+                       rabbit_log:error("Refusing to boot due to an invalid value of 'rabbit.credit_flow_default_credit'"),
+                       throw({error, {invalid_credit_flow_default_credit_value, Other}})
+               end,
+    ok = persistent_term:put(credit_flow_default_credit, CreditFlowDefaultCredit),
+
     %% Disallow 0 as it means unlimited:
     %% "If this field is zero or unset, there is no maximum
     %% size imposed by the link endpoint." [AMQP 1.0 §2.7.3]

deps/rabbitmq_cli/lib/rabbitmq/cli/diagnostics/commands/check_certificate_expiration_command.ex

@@ -7,10 +7,11 @@
 defmodule RabbitMQ.CLI.Diagnostics.Commands.CheckCertificateExpirationCommand do
   alias RabbitMQ.CLI.Core.DocGuide
   alias RabbitMQ.CLI.TimeUnit, as: TU
-  @behaviour RabbitMQ.CLI.CommandBehaviour
 
   import RabbitMQ.CLI.Core.Listeners
 
+  @behaviour RabbitMQ.CLI.CommandBehaviour
+
   def switches(), do: [unit: :string, within: :integer]
 
   def merge_defaults(args, opts) do
@@ -102,9 +103,10 @@ defmodule RabbitMQ.CLI.Diagnostics.Commands.CheckCertificateExpirationCommand do
 
   def help_section(), do: :observability_and_health_checks
 
-  def description(),
-    do: "Checks the expiration date on the certificates for every listener configured to use TLS"
+  def description() do
+    "Checks the expiration date of every certificate (leaf, intermediary or any CA) in every certificate bundle file used by the node"
+  end
 
   def banner(_, %{node: node_name}),
-    do: "Checking certificate expiration on node #{node_name} ..."
+    do: "Checking certificate expiration for all certificates on node #{node_name} ..."
 end