title: RabbitMQ TLS Authentication
body: <p><br>
  There is a task to configure the operation of some web services using certificate authorization.<br>
  There is:<br>
  Erlang 22.3.3<br>
  RabbitMQ 3.8.3<br>
  It makes no sense to describe their installation.<br>
  What has been done next:<br>
  1. In accordance with the article (<a href="https://www.rabbitmq.com/ssl.html" rel="nofollow noreferrer">https://www.rabbitmq.com/ssl.html</a>) we perform the following actions:</p>
  
  <pre><code>git clone https://github.com/michaelklishin/tls-gen tls-gen
  cd tls-gen / basic
  CN = client PASSWORD = 123 make
  make verify
  make info
  </code></pre>
  
  <ol start="2">
  <li><p>Copy the created certificates, change the owner</p>
  
  <p><code>mv testca/ /etc/rabbitmq/
  mv server/ /etc/rabbitmq/
  mv client/ /etc/rabbitmq/
  chown -R rabbitmq: /etc/rabbitmq/testca
  chown -R rabbitmq: /etc/rabbitmq/server
  chown -R rabbitmq: /etc/rabbitmq/client</code></p></li>
  <li><p>We bring the configuration file to the form (/etc/rabbitmq/rabbitmq.config):</p>
  
  <p><code>[
    {ssl, [{versions, ['tlsv1.2', 'tlsv1.1', tlsv1]}]},
    {rabbit, [
       {ssl_listeners, [5671]},
  {auth_mechanisms, ['PLAIN', 'AMQPLAIN', 'EXTERNAL']},
  {ssl_cert_login_from, 'client'},
       {ssl_options, [{cacertfile, "/ etc / rabbitmq / testca / cacert.pem"},
                      {certfile, "/ etc / rabbitmq / server / cert.pem"},
                      {keyfile, "/ etc / rabbitmq / server / key.pem"},
  {verify, verify_peer},
                      {fail_if_no_peer_cert, true}]}]}}
  ].</code></p></li>
  <li><p>We start the server, try to connect from the client. We get the error:</p>
  
  <p>2020-05-18 17: 21: 57.166 +03: 00 [ERR] Failed to connect to broker 10.10.11.16, port 5671, vhost dmz
  RabbitMQ.Client.Exceptions.BrokerUnreachableException: None of the specified endpoints were reachable
   ---> RabbitMQ.Client.Exceptions.PossibleAuthenticationFailureException: Possibly caused by authentication failure
   ---> RabbitMQ.Client.Exceptions.OperationInterruptedException: The AMQP operation was interrupted: AMQP close-reason, initiated by Library, code = 0, text = 'End of stream', classId = 0, methodId = 0, cause = System .IO.EndOfStreamException: Reached the end of the stream. Possible authentication failure.
     at RabbitMQ.Client.Impl.InboundFrame.ReadFrom (Stream reader)
     at RabbitMQ.Client.Impl.SocketFrameHandler.ReadFrame ()
     at RabbitMQ.Client.Framing.Impl.Connection.MainLoopIteration ()
     at RabbitMQ.Client.Framing.Impl.Connection.MainLoop ()
     at RabbitMQ.Client.Impl.SimpleBlockingRpcContinuation.GetReply (TimeSpan timeout)
     at RabbitMQ.Client.Impl.ModelBase.ConnectionStartOk (IDictionary`2 clientProperties, String mechanism, Byte [] response, String locale)
     at RabbitMQ.Client.Framing.Impl.Connection.StartAndTune ()
     --- End of inner exception stack trace ---
     at RabbitMQ.Client.Framing.Impl.Connection.StartAndTune ()
     at RabbitMQ.Client.Framing.Impl.Connection.Open (Boolean insist)
     at RabbitMQ.Client.Framing.Impl.Connection..ctor (IConnectionFactory factory, Boolean insist, IFrameHandler frameHandler, String clientProvidedName)
     at RabbitMQ.Client.Framing.Impl.ProtocolBase.CreateConnection (IConnectionFactory factory, Boolean insist, IFrameHandler frameHandler, String clientProvidedName)
     at RabbitMQ.Client.ConnectionFactory.CreateConnection (IEndpointResolver endpointResolver, String clientProvidedName)
     --- End of inner exception stack trace ---
     at RabbitMQ.Client.ConnectionFactory.CreateConnection (IEndpointResolver endpointResolver, String clientProvidedName)
     at RabbitMQ.Client.ConnectionFactory.CreateConnection (String clientProvidedName)
     at EasyNetQ.ConnectionFactoryWrapper.CreateConnection ()
     at EasyNetQ.PersistentConnection.TryToConnect ()</p></li>
  </ol>
  
  <p>In the rabbitmq log:</p>
  
  <pre><code>2020-05-18 17: 24: 59.880 [info] &lt;0.3442.0&gt; accepting AMQP connection &lt;0.3442.0&gt; (10/10/15/14/1561 -&gt; 10/10/11/166767)
  2020-05-18 17: 25: 02.887 [error] &lt;0.3442.0&gt; closing AMQP connection &lt;0.3442.0&gt; (10/10/15/14/1561 -&gt; 10/10/11/1667671):
  {handshake_error, starting, 0, {error, function_clause, 'connection.start_ok', [{rabbit_ssl, peer_cert_auth_name, [client, &lt;&lt; 48,130,3,42,48,130,2,18,160,3,2,1,2,2 , 1,2,48,13,6,9,42,134,72,134,247,13,1,1,11,5,0,48,4,49,49,32,48,30,6,3,85,4,3 12,23,84,76,83,71,101,110,83,101,108,102,83,105,103,110,101,100,116,82,111,111,116,67,65,49,13,48,11,6,3,85,4,7,12,4,36,36,36 , 36.48,30,23,13,50,48,48,53,49,56,49,52,48,49,53,53,90,23,13,51,48,48,53,49 , 54,49,52,48,49,53,53,90,48,34,49,15,48,13,6,3,85,4,3,12,6,99,108,105,101,110,116,49,15,48 , 13,6,3,85,4,10,12,6,99,108,105,101,110,116,48,130,1,34,48,13,6,9,42,134,72,134,247,13,1,1,1,5,0,3,130 1,15,0,48,130,1,10,2,130,1,1,0,183,198,116,156,3,177,131,5,148,11,154,34,99,210,88,115,60,228,180,245,80,212,113,57,181,249,20,5,164,49,72,95,153,116,103,49 , 58,119,15,48,147,107,112,243,105,122,189,44,0,193,114,138,169,250,165,97,188,158,188,95,163,37,30,75,143,21,103,11,131,223,124,96,244,111,210,30,8,175,72,206,162,14,86,63,146,215,179,226,239,48,76,122,150,200,183,82,114,1 73,116,32,224,202,196,129,131,96,34,237,34,144,177,92,200,105,212,0,133,141,118,146,229,140,246,229,137,0,9,27,180,163,233,134,0,187,110,9,126,92,172,105,96,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,1,118,11,11,118,11,118,11,118,11,118,11,118,11,118,11,118,11,118,11,118,11,118,11,118,1,118,11,11,118,11,11,11,11,1,1,1,1,1,1,1,1,1,1,1,1,1,111,1'''1,11,11,1'''1,1''''N''O'', '' 92,181,68,172,135,15,90,152,209,242,31,138,135,34,95,29,162,226,175,253,176,14
  </code></pre>
  
  <hr>
  
  <p><strong>UPDATE</strong><br>
  New rabbitmq.config:</p>
  
  <pre><code>[
          {rabbit,[
          {auth_backends, [rabbit_auth_backend_internal]},
                  {auth_mechanisms, ['PLAIN', 'AMQPLAIN', 'EXTERNAL']},
                  {ssl_listeners,[5671]},
                  {ssl_options,[
                              {versions,['tlsv1.2', 'tlsv1.1']},
                              {cacertfile, "/etc/rabbitmq/testca/cacert.pem"},
                              {certfile, "/etc/rabbitmq/server/cert.pem"},
                              {keyfile, "/etc/rabbitmq/server/key.pem"},
                              {verify,verify_peer},
                              {fail_if_no_peer_cert,true}]}
          ]}
  ].
  </code></pre>
  
  <p>New error:</p>
  
  <pre><code>2020-05-18 18:48:56.681 [info] &lt;0.1410.0&gt; Connection &lt;0.1410.0&gt; (10.10.15.14:52744 -&gt; 10.10.11.16:5671) has a client-provided name: Viber.CallbackService.dll
  2020-05-18 18:48:56.682 [error] &lt;0.1410.0&gt; Error on AMQP connection &lt;0.1410.0&gt; (10.10.15.14:52744 -&gt; 10.10.11.16:5671, state: starting):
  EXTERNAL login refused: user 'O=client,CN=client' - invalid credentials
  </code></pre>