[💡 FEATURE REQUEST]: SSL Support for the AMQP driver.

[marcosraudkett]

Plugin

JOBS

I have an idea!

The problem is that you can't connect to RabbitMQ that uses SSL (port 5671) with the current driver and I'm requesting support for it:

e.g.

Config:

ca_certicate       string `mapstructure:"ca_certicate"`
client_certificate string `mapstructure:"client_certificate"`
client_key         string `mapstructure:"client_key"`
server_name        string `mapstructure:"server_name"`

Connection:

import (
	"crypto/tls"
	"crypto/x509"
	"io/ioutil"
)

caCert, err := ioutil.ReadFile(conf.ca_certicate)
if err != nil {
	return nil, errors.E(op, err)
}

cert, err := tls.LoadX509KeyPair(conf.client_certificate, conf.client_key)
if err != nil {
	return nil, errors.E(op, err)
}

rootCAs := x509.NewCertPool()
rootCAs.AppendCertsFromPEM(caCert)

tlsConf := &tls.Config{
	RootCAs:      rootCAs,
	Certificates: []tls.Certificate{cert},
	ServerName:   conf.server_name, // Optional
}

jb.conn, err = amqp.DialTLS(
	fmt.Sprintf(conf.Addr),
	tlsConf,
)
if err != nil {
	return nil, errors.E(op, err)
}

And then in rr.yaml:

amqp:
  addr: amqps://guest:guest@mydomain.com:5671
  ca_certificate: # path to cert
  client_certificate: # path to cert
  client_key: # path to cert
  server_name: mydomain.com

This is just a rough example.

[rustatian]

Hey @marcosraudkett 👋🏻
This is a good idea 👍🏻 We should also support mTLS, I think, but I'm not sure if rabbitMQ supports it.

I will move this FR to the v2023.2.0 milestone for now.

[andrei-dascalu]

will there be an option to disable peer verification? Could be useful for self-signed certificates to prevent errors due to missing CA.

[rustatian]

will there be an option to disable peer verification? Could be useful for self-signed certificates to prevent errors due to missing CA.

Are you referring to the mTLS, am I right? An option to disable mutual TSL.

[rustatian]

If you're saying about this: https://www.rabbitmq.com/ssl.html#peer-verification-configuration, then yes, you'll be able to opt-out from the mTLS verification.

[rustatian]

Feature is ready, will be next Thursday in the first beta release

Generally would be possible to verify peer (mTLS) as well as turn off that feature.