Impossible to use SSL connections #477

galzetta · 2021-03-26T16:22:40Z

galzetta
Mar 26, 2021

I'm trying to run a RabbitMQ Pod with SSL on a Kubernetes cluster.

I define the env variables:

- name: RABBITMQ_MANAGEMENT_SSL_CACERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_MANAGEMENT_SSL_CERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_MANAGEMENT_SSL_KEYFILE
  value: /certs/rabbit_cert.key
- name: RABBITMQ_SSL_CACERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_SSL_CERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_SSL_KEYFILE
  value: /certs/rabbit_cert.key

(obviously a test setup)

In the logs I see that the listeners for SSL do start:

2021-03-26 15:47:25.475 [info] <0.44.0> Application cowlib started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.476 [info] <0.44.0> Application cowboy started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.477 [info] <0.44.0> Application rabbitmq_web_dispatch started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.478 [info] <0.44.0> Application amqp_client started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.589 [info] <0.812.0> Management plugin: HTTPS listener started on port 15671
2021-03-26 15:47:25.590 [info] <0.920.0> Statistics database started.
2021-03-26 15:47:25.590 [info] <0.919.0> Starting worker pool 'management_worker_pool' with 3 processes in it
2021-03-26 15:47:25.593 [info] <0.44.0> Application rabbitmq_management started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.675 [info] <0.44.0> Application prometheus started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.691 [info] <0.933.0> Prometheus metrics: HTTP (non-TLS) listener started on port 15692
2021-03-26 15:47:25.693 [info] <0.44.0> Application rabbitmq_prometheus started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.692 [info] <0.753.0> Ready to start client connection listeners
2021-03-26 15:47:25.700 [info] <0.1052.0> started TCP listener on [::]:5672
2021-03-26 15:47:25.705 [info] <0.1069.0> started TLS (SSL) listener on [::]:5671
2021-03-26 15:47:28.703 [info] <0.753.0> Server startup complete; 4 plugins started.

Unfortunately if I do rabbitmq-diagnostics status it gives an error:

Error: unable to perform an operation on node 'rabbit@rabbitmq-a'. Please see diagnostics information and suggestions below.

Most common reasons for this are:

 * Target node is unreachable (e.g. due to hostname resolution, TCP connection or firewall issues)
 * CLI tool fails to authenticate with the server (e.g. due to CLI tool's Erlang cookie not matching that of the server)
 * Target node is not running

In addition to the diagnostics info below:

 * See the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more
 * Consult server logs on node rabbit@rabbitmq-a
 * If target node is configured to use long node names, don't forget to use --longnames with CLI tools

DIAGNOSTICS
===========

attempted to contact: ['rabbit@rabbitmq-a']

rabbit@rabbitmq-a:
  * connected to epmd (port 4369) on rabbitmq-a
  * epmd reports: node 'rabbit' not running at all
                  other nodes on rabbitmq-a: ['rabbitmqcli-415-rabbit']
  * suggestion: start the node

Current node details:
 * node name: 'rabbitmqcli-481-rabbit@rabbitmq-a'
 * effective user's home directory: /var/lib/rabbitmq
 * Erlang cookie hash:<some hash>

Starting the container without SSL works fine and rabbitmq-diagnostics status returns the correct output without errors.

Note that this is a single container, so there is no cluster, no possible problem with multiple nodes being out of sync etc.

Running netstat -tulpn inside the container I see that the listeners are active (although I don't understand why some ports are bound to localhost and other to 0.0.0.0...):

# netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:25672           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:15692           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:4369            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:15671           0.0.0.0:*               LISTEN      -
tcp        0      0 :::5671                 :::*                    LISTEN      -
tcp        0      0 :::5672                 :::*                    LISTEN      -
tcp        0      0 :::4369                 :::*                    LISTEN      -

If I try to telnet 127.0.0.1 5671 it connects (with 5672 too).

Here are the logs:
logs-from-rabbitmq-a-in-rabbitmq-a.txt

Is this a bug in the docker image or a problem on how SSL is configured. The docker Hub page simply says to use the env variables without any information and I tried to follow a couple of online guides to generate the correct certificates and IMHO if the listeners start that should mean Rabbit liked the certificates, right?

I forgot to mention, my application using Micronaut fails to connect with this error:

Caused by: io.micronaut.messaging.exceptions.MessageListenerException: Failed to retrieve a channel pool named [default] to register a listener
	at io.micronaut.rabbitmq.intercept.RabbitMQConsumerAdvice.process(RabbitMQConsumerAdvice.java:124)
	at io.micronaut.rabbitmq.intercept.RabbitMQConsumerAdvice.process(RabbitMQConsumerAdvice.java:67)
	at io.micronaut.context.AnnotationProcessorListener.onCreated(AnnotationProcessorListener.java:95)
	... 15 common frames omitted
Caused by: io.micronaut.context.exceptions.BeanInstantiationException: Error creating connection to RabbitMQ
	at io.micronaut.rabbitmq.connect.RabbitConnectionFactory.connection(RabbitConnectionFactory.java:62)
	at io.micronaut.rabbitmq.connect.$RabbitConnectionFactory$Connection0Definition.build(Unknown Source)
	at io.micronaut.context.BeanDefinitionDelegate.build(BeanDefinitionDelegate.java:153)
	at io.micronaut.context.DefaultBeanContext.doCreateBean(DefaultBeanContext.java:1943)
	at io.micronaut.context.DefaultBeanContext.createAndRegisterSingletonInternal(DefaultBeanContext.java:2724)
	at io.micronaut.context.DefaultBeanContext.createAndRegisterSingleton(DefaultBeanContext.java:2710)
	at io.micronaut.context.DefaultBeanContext.getBeanForDefinition(DefaultBeanContext.java:2382)
	at io.micronaut.context.DefaultBeanContext.getBeanInternal(DefaultBeanContext.java:2356)
	at io.micronaut.context.DefaultBeanContext.findBean(DefaultBeanContext.java:1282)
	at io.micronaut.context.DefaultBeanContext.findBean(DefaultBeanContext.java:752)
	at io.micronaut.context.BeanDefinitionDelegate.build(BeanDefinitionDelegate.java:142)
	at io.micronaut.context.DefaultBeanContext.doCreateBean(DefaultBeanContext.java:1943)
	at io.micronaut.context.DefaultBeanContext.createAndRegisterSingletonInternal(DefaultBeanContext.java:2724)
	at io.micronaut.context.DefaultBeanContext.createAndRegisterSingleton(DefaultBeanContext.java:2710)
	at io.micronaut.context.DefaultBeanContext.getBeanForDefinition(DefaultBeanContext.java:2382)
	at io.micronaut.context.DefaultBeanContext.getBeanInternal(DefaultBeanContext.java:2356)
	at io.micronaut.context.DefaultBeanContext.getBean(DefaultBeanContext.java:729)
	at io.micronaut.rabbitmq.intercept.RabbitMQConsumerAdvice.process(RabbitMQConsumerAdvice.java:122)
	... 17 common frames omitted
Caused by: javax.net.ssl.SSLException: readHandshakeRecord
	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl$AppOutputStream.write(Unknown Source)
	at java.base/java.io.BufferedOutputStream.flushBuffer(Unknown Source)
	at java.base/java.io.BufferedOutputStream.flush(Unknown Source)
	at java.base/java.io.DataOutputStream.flush(Unknown Source)
	at com.rabbitmq.client.impl.SocketFrameHandler.sendHeader(SocketFrameHandler.java:160)
	at com.rabbitmq.client.impl.SocketFrameHandler.sendHeader(SocketFrameHandler.java:170)
	at com.rabbitmq.client.impl.AMQConnection.start(AMQConnection.java:314)
	at com.rabbitmq.client.impl.recovery.RecoveryAwareAMQConnectionFactory.newConnection(RecoveryAwareAMQConnectionFactory.java:64)
	at com.rabbitmq.client.impl.recovery.AutorecoveringConnection.init(AutorecoveringConnection.java:156)
	at com.rabbitmq.client.ConnectionFactory.newConnection(ConnectionFactory.java:1130)
	at com.rabbitmq.client.ConnectionFactory.newConnection(ConnectionFactory.java:1087)
	at com.rabbitmq.client.ConnectionFactory.newConnection(ConnectionFactory.java:1045)
	at com.rabbitmq.client.ConnectionFactory.newConnection(ConnectionFactory.java:1238)
	at io.micronaut.rabbitmq.connect.RabbitConnectionFactory.connection(RabbitConnectionFactory.java:59)
	... 34 common frames omitted
	Suppressed: java.net.SocketException: Broken pipe (Write failed)
		at java.base/java.net.SocketOutputStream.socketWrite0(Native Method)
		at java.base/java.net.SocketOutputStream.socketWrite(Unknown Source)
		at java.base/java.net.SocketOutputStream.write(Unknown Source)
		at java.base/sun.security.ssl.SSLSocketOutputRecord.encodeAlert(Unknown Source)
		at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
		at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
		... 50 common frames omitted
Caused by: java.net.SocketException: Connection reset by peer (Write failed)
	at java.base/java.net.SocketOutputStream.socketWrite0(Native Method)
	at java.base/java.net.SocketOutputStream.socketWrite(Unknown Source)
	at java.base/java.net.SocketOutputStream.write(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketOutputRecord.flush(Unknown Source)
	at java.base/sun.security.ssl.HandshakeOutStream.flush(Unknown Source)
	at java.base/sun.security.ssl.ECDHClientKeyExchange$ECDHEClientKeyExchangeProducer.produce(Unknown Source)
	at java.base/sun.security.ssl.ClientKeyExchange$ClientKeyExchangeProducer.produce(Unknown Source)
	at java.base/sun.security.ssl.SSLHandshake.produce(Unknown Source)
	at java.base/sun.security.ssl.ServerHelloDone$ServerHelloDoneConsumer.consume(Unknown Source)
	at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
	... 51 common frames omitted

So it's not an out-right connection refused.

wglambert · 2021-03-26T16:31:09Z

wglambert
Mar 26, 2021

Half your environment variables are for the management variant and half are for the non-management

https://github.com/docker-library/docs/tree/master/rabbitmq#environment-variables

For SSL configuration without the management plugin:
. . .

For SSL configuration using the management plugin:
. . .

Following the example at https://www.rabbitmq.com/ssl.html#automated-certificate-generation-transcript I was able to get ssl working #376 (comment)
See also #470

2 replies

galzetta Mar 26, 2021
Author

I first tried to use the management ones since I use the management image but it does not work, same with just the others.

Results using only the non-management env vars with the image rabbitmq:3-management-alpine

- name: RABBITMQ_SSL_CACERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_SSL_CERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_SSL_KEYFILE
  value: /certs/rabbit_cert.key

The health checks do not work:

Error: unable to perform an operation on node 'rabbit@rabbitmq-a'. Please see diagnostics information and suggestions below.

Most common reasons for this are:

 * Target node is unreachable (e.g. due to hostname resolution, TCP connection or firewall issues)
 * CLI tool fails to authenticate with the server (e.g. due to CLI tool's Erlang cookie not matching that of the server)
 * Target node is not running

In addition to the diagnostics info below:

 * See the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more
 * Consult server logs on node rabbit@rabbitmq-a
 * If target node is configured to use long node names, don't forget to use --longnames with CLI tools

DIAGNOSTICS
===========

attempted to contact: ['rabbit@rabbitmq-a']

rabbit@rabbitmq-a:
  * connected to epmd (port 4369) on rabbitmq-a
  * epmd reports node 'rabbit' uses port 25672 for inter-node and CLI tool traffic 
  * TCP connection succeeded but Erlang distribution failed 
  * suggestion: check if the Erlang cookie identical for all server nodes and CLI tools
  * suggestion: check if all server nodes and CLI tools use consistent hostnames when addressing each other
  * suggestion: check if inter-node connections may be configured to use TLS. If so, all nodes and CLI tools must do that
   * suggestion: see the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more


Current node details:
 * node name: 'rabbitmqcli-899-rabbit@rabbitmq-a'
 * effective user's home directory: /var/lib/rabbitmq
 * Erlang cookie hash: +uburyyqUW1rZzkJdDeEjg==

bash-5.1# rabbitmqctl status
Error: unable to perform an operation on node 'rabbit@rabbitmq-a'. Please see diagnostics information and suggestions below.

Most common reasons for this are:

 * Target node is unreachable (e.g. due to hostname resolution, TCP connection or firewall issues)
 * CLI tool fails to authenticate with the server (e.g. due to CLI tool's Erlang cookie not matching that of the server)
 * Target node is not running

In addition to the diagnostics info below:

 * See the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more
 * Consult server logs on node rabbit@rabbitmq-a
 * If target node is configured to use long node names, don't forget to use --longnames with CLI tools

DIAGNOSTICS
===========

attempted to contact: ['rabbit@rabbitmq-a']

rabbit@rabbitmq-a:
  * connected to epmd (port 4369) on rabbitmq-a
  * epmd reports node 'rabbit' uses port 25672 for inter-node and CLI tool traffic 
  * TCP connection succeeded but Erlang distribution failed 
  * suggestion: check if the Erlang cookie identical for all server nodes and CLI tools
  * suggestion: check if all server nodes and CLI tools use consistent hostnames when addressing each other
  * suggestion: check if inter-node connections may be configured to use TLS. If so, all nodes and CLI tools must do that
   * suggestion: see the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more


Current node details:
 * node name: 'rabbitmqcli-423-rabbit@rabbitmq-a'
 * effective user's home directory: /var/lib/rabbitmq
 * Erlang cookie hash: +uburyyqUW1rZzkJdDeEjg==

From the logs the listeners seem to start fine:

logs-from-rabbitmq-a-in-rabbitmq-a.txt

Results using onl the management env vars with the image rabbitmq:3-management-alpine:

- name: RABBITMQ_MANAGEMENT_SSL_CACERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_MANAGEMENT_SSL_CERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_MANAGEMENT_SSL_KEYFILE
  value: /certs/rabbit_cert.key

RabbitMQ does not listen with SSL on port 5671:

bash-5.1# netstat -tlpun
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:15671           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:25672           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:15692           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:4369            0.0.0.0:*               LISTEN      -
tcp        0      0 :::5672                 :::*                    LISTEN      -
tcp        0      0 :::4369                 :::*                    LISTEN      -

However in this case the health checks do work, although RabbitMQ is not listening in SSL, only the management interface is listening in SSL:

bash-5.1# rabbitmq-diagnostics status
Status of node rabbit@rabbitmq-irp ...
Runtime

OS PID: 407
OS: Linux
Uptime (seconds): 58
Is under maintenance?: false
RabbitMQ version: 3.8.14
Node name: rabbit@rabbitmq-irp
Erlang configuration: Erlang/OTP 23 [erts-11.1.8] [source] [64-bit] [smp:8:1] [ds:8:1:10] [async-threads:1]
Erlang processes: 590 used, 1048576 limit
Scheduler run queue: 1
Cluster heartbeat timeout (net_ticktime): 60

Plugins

Enabled plugin file: /etc/rabbitmq/enabled_plugins
Enabled plugins:

 * rabbitmq_prometheus
 * prometheus
 * rabbitmq_management
 * amqp_client
 * rabbitmq_web_dispatch
 * cowboy
 * cowlib
 * rabbitmq_management_agent

Data directory

Node data directory: /var/lib/rabbitmq/mnesia/rabbit@rabbitmq-irp
Raft data directory: /var/lib/rabbitmq/mnesia/rabbit@rabbitmq-irp/quorum/rabbit@rabbitmq-irp

Config files

 * /etc/rabbitmq/rabbitmq.conf

Log file(s)

 * <stdout>

Alarms

(none)

Memory

Total memory used: 0.1183 gb
Calculation strategy: rss
Memory high watermark setting: 0.4 of available memory, computed to: 0.2147 gb

other_proc: 0.0342 gb (27.7 %)
code: 0.0331 gb (26.84 %)
other_system: 0.0284 gb (22.98 %)
allocated_unused: 0.0127 gb (10.25 %)
plugins: 0.0091 gb (7.35 %)
other_ets: 0.0033 gb (2.67 %)
atom: 0.0015 gb (1.19 %)
binary: 0.0004 gb (0.33 %)
metrics: 0.0002 gb (0.2 %)
mgmt_db: 0.0002 gb (0.14 %)
connection_other: 0.0001 gb (0.11 %)
mnesia: 0.0001 gb (0.08 %)
connection_readers: 0.0001 gb (0.04 %)
quorum_ets: 0.0 gb (0.04 %)
queue_procs: 0.0 gb (0.03 %)
msg_index: 0.0 gb (0.02 %)
connection_channels: 0.0 gb (0.01 %)
connection_writers: 0.0 gb (0.0 %)
queue_slave_procs: 0.0 gb (0.0 %)
quorum_queue_procs: 0.0 gb (0.0 %)
reserved_unallocated: 0.0 gb (0.0 %)

File Descriptors

Total: 4, limit: 1048479
Sockets: 2, limit: 943629

Free Disk Space

Low free disk space watermark: 0.05 gb
Free disk space: 16.0562 gb

Totals

Connection count: 2
Queue count: 2
Virtual host count: 1

Listeners

Interface: [::], port: 15671, protocol: https, purpose: HTTP API over TLS (HTTPS)
Interface: [::], port: 15692, protocol: http/prometheus, purpose: Prometheus exporter API over HTTP
Interface: [::], port: 25672, protocol: clustering, purpose: inter-node and CLI tool communication
Interface: [::], port: 5672, protocol: amqp, purpose: AMQP 0-9-1 and AMQP 1.0
bash-5.1# rabbitmqctl status
Status of node rabbit@rabbitmq-irp ...
Runtime

OS PID: 407
OS: Linux
Uptime (seconds): 81
Is under maintenance?: false
RabbitMQ version: 3.8.14
Node name: rabbit@rabbitmq-irp
Erlang configuration: Erlang/OTP 23 [erts-11.1.8] [source] [64-bit] [smp:8:1] [ds:8:1:10] [async-threads:1]
Erlang processes: 590 used, 1048576 limit
Scheduler run queue: 1
Cluster heartbeat timeout (net_ticktime): 60

Plugins

Enabled plugin file: /etc/rabbitmq/enabled_plugins
Enabled plugins:

 * rabbitmq_prometheus
 * prometheus
 * rabbitmq_management
 * amqp_client
 * rabbitmq_web_dispatch
 * cowboy
 * cowlib
 * rabbitmq_management_agent

Data directory

Node data directory: /var/lib/rabbitmq/mnesia/rabbit@rabbitmq-irp
Raft data directory: /var/lib/rabbitmq/mnesia/rabbit@rabbitmq-irp/quorum/rabbit@rabbitmq-irp

Config files

 * /etc/rabbitmq/rabbitmq.conf

Log file(s)

 * <stdout>

Alarms

(none)

Memory

Total memory used: 0.1145 gb
Calculation strategy: rss
Memory high watermark setting: 0.4 of available memory, computed to: 0.2147 gb

other_proc: 0.0342 gb (27.73 %)
code: 0.0331 gb (26.84 %)
other_system: 0.0284 gb (22.98 %)
allocated_unused: 0.0126 gb (10.2 %)
plugins: 0.0091 gb (7.38 %)
other_ets: 0.0033 gb (2.67 %)
atom: 0.0015 gb (1.19 %)
binary: 0.0004 gb (0.33 %)
metrics: 0.0002 gb (0.2 %)
mgmt_db: 0.0002 gb (0.15 %)
connection_other: 0.0001 gb (0.11 %)
mnesia: 0.0001 gb (0.08 %)
quorum_ets: 0.0 gb (0.04 %)
connection_readers: 0.0 gb (0.04 %)
queue_procs: 0.0 gb (0.03 %)
msg_index: 0.0 gb (0.02 %)
connection_channels: 0.0 gb (0.01 %)
connection_writers: 0.0 gb (0.0 %)
queue_slave_procs: 0.0 gb (0.0 %)
quorum_queue_procs: 0.0 gb (0.0 %)
reserved_unallocated: 0.0 gb (0.0 %)

File Descriptors

Total: 4, limit: 1048479
Sockets: 2, limit: 943629

Free Disk Space

Low free disk space watermark: 0.05 gb
Free disk space: 16.0563 gb

Totals

Connection count: 2
Queue count: 2
Virtual host count: 1

Listeners

Interface: [::], port: 15671, protocol: https, purpose: HTTP API over TLS (HTTPS)
Interface: [::], port: 15692, protocol: http/prometheus, purpose: Prometheus exporter API over HTTP
Interface: [::], port: 25672, protocol: clustering, purpose: inter-node and CLI tool communication
Interface: [::], port: 5672, protocol: amqp, purpose: AMQP 0-9-1 and AMQP 1.0

In this second case my client simply gets a Connection refused, while in the first case it gets a Broken pipe error.

galzetta Mar 26, 2021
Author

In other words all combinations of env variables fails.

yosifkit · 2021-03-26T18:33:07Z

yosifkit
Mar 26, 2021
Maintainer

Did you run rabbitmq-diagnostics status with extra ssl arguments/environment variables like the entrypoint sets up for rabbitmqctl?

rabbitmq/docker-entrypoint.sh

Lines 412 to 415 in 6fde356

    
           export ERL_SSL_PATH="$(erl -eval 'io:format("~p", [code:lib_dir(ssl, ebin)]),halt().' -noshell)" 
        
           sslErlArgs="-pa $ERL_SSL_PATH -proto_dist inet_tls -ssl_dist_opt server_certfile $combinedSsl -ssl_dist_opt server_secure_renegotiate true client_secure_renegotiate true" 
        
           export RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS="${RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS:-} $sslErlArgs" 
        
           export RABBITMQ_CTL_ERL_ARGS="${RABBITMQ_CTL_ERL_ARGS:-} $sslErlArgs"

Or try running it through the entrypoint: docker exec rabbit-container docker-entrypoint.sh rabbitmq-diagnostics status

1 reply

galzetta Mar 29, 2021
Author

Using docker-entrypoint.sh seems to help. Why isn't it mentioned in the DockerHub page? An addition in the section "Health/Liveness/Readiness Checking" of https://hub.docker.com/_/rabbitmq would be helpful.

The other thing that was missing is that I had to specify RABBITMQ_SSL_FAIL_IF_NO_PEER_CERT=false no enable clients without a certificate.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Impossible to use SSL connections #477

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 3 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Impossible to use SSL connections #477

galzetta Mar 26, 2021

Replies: 2 comments · 3 replies

wglambert Mar 26, 2021

galzetta Mar 26, 2021 Author

galzetta Mar 26, 2021 Author

yosifkit Mar 26, 2021 Maintainer

galzetta Mar 29, 2021 Author

galzetta
Mar 26, 2021

Replies: 2 comments 3 replies

wglambert
Mar 26, 2021

galzetta Mar 26, 2021
Author

galzetta Mar 26, 2021
Author

yosifkit
Mar 26, 2021
Maintainer

galzetta Mar 29, 2021
Author