[Messenger] Remove TLS related options when not using TLS

[odolbeau]

Q	A
Branch?	5.2
Bug fix?	not really
New feature?	no
Deprecations?	no
Tickets	-
License	MIT
Doc PR	-

Remove TLS related options when not using TLS to connect to a broker.

The goal is to be able to use the same configuration for both amqp:// & amqps:// DSN.

Currently, when using a configuration containing a cacert key with a non-TLS DSN will throw a AMQPConnectionException (Socket error: could not connect to host.)

Configuration example:

framework:
    messenger:
        transports:
            async:
              dsn: '%env(MESSENGER_TRANSPORT_DSN)%'
              options:
                cacert: '%kernel.project_dir%/amqp_cacert.pem'

[YaFou]

Can you implement a test, please?

[chalasr]

👍 as a bugfix for 5.2

[javiereguiluz]

I don't know if my question makes sense ... but I'll ask it: if we silently drop the TLS config when using amqp:// instead of amqps:// ... what would happen if someone makes a mistake in their configuration and forgot to add the s of amqps (or removes it unwillingly) ?

Before, this typo would have been caught by the exception ... but now that typo could become a potential security issue?

[odolbeau]

@javiereguiluz if your broker is configured to accept both TLS & non-TLS connections, you are right, the non-TLS connection will be used even if it's not what you were looking for.
That's why I filled Bugfix: not really: you won't have the error anymore but IMO it improves the DX: you don't have to worry about TLS & non-TLS connections (for prod / dev env typically), both will work with the same configuration.

[nicolas-grekas]

Thank you @odolbeau.