title: Cannot connect to Rabbitmq using SSL
body: <p>I have been trying to connect to <code>Rabbitmq</code> via <code>SSL</code>.
  The steps I followed are as below:</p>
  
  <ol>
  <li><p>Generated certificates and pem file on server using <a href="https://github.com/michaelklishin/tls-gen" rel="nofollow noreferrer">tls-gen</a> </p>
  
  <p>Files generated were as follows:</p>
  
  <ul>
  <li><p>server_key.pem</p></li>
  <li><p>server_certificate.pem</p></li>
  <li><p>client_key.pem</p></li>
  <li><p>client_certificate.pem</p></li>
  <li><p>ca_key.pem</p></li>
  <li><p>ca_certificate.pem  </p></li>
  </ul></li>
  <li><p>Following this link <a href="https://www.rabbitmq.com/ssl.html#enabling-ssl" rel="nofollow noreferrer">enabling ssl rabbitmq</a>, I have created a file called <code>rabbitmq.config</code> under <code>/etc/rabbitmq</code>, copied a default configuration file and un-commented the lines:</p>
  
  <p><code>[
  {rabbit, [
   {tcp_listeners, [5671]},
   {ssl_listeners, [5672]},
   {auth_mechanisms, ['EXTERNAL','PLAIN']},
   {ssl_options, [{cacertfile,"/path/to/ca_certificate.pem"},
                  {certfile,"/path/to/server_certificate.pem"},
                  {keyfile,"/path/to/server_key.pem"},
                  {verify,verify_peer},
                  {fail_if_no_peer_cert,false}]}
  ]}
  ].</code></p></li>
  <li><p>I have copied the client keys to the machine I am trying to connect to rabbitmq from and am using the following paramters:</p>
  
  <p><code>RABBITMQ_CONNECTION_PARAMETERS = {'host': 'rabbitmqHost', 'port': 5671,
                                'heartbeat_interval': 0,
                                'ssl': True,
                                'ssl_options':        {'certfile':'client_certificate.pem',
  'keyfile': 'client_key.pem',
  }
  }</code></p></li>
  </ol>
  
  <p>as per the parameters specified in this <a href="https://pika.readthedocs.io/en/0.10.0/examples/using_urlparameters.html#example-connection-urls" rel="nofollow noreferrer">link</a></p>
  
  <p>Without SSL enabled and using Plain Credentials I am able to connect to rabbitmq server. However, using the above setup, I get the below error in connecting:</p>
  
  <blockquote>
    <p>DEBUG:pika.callback:Added: {'callback': >, 'only': None, 'one_shot': False, 'arguments': None}
    2017-03-10 16:00:23 [pika.callback] DEBUG: Added: {'callback': >, 'only': None, 'one_shot': False, 'arguments': None}
    DEBUG:pika.callback:Added: {'callback': >, 'only': None, 'one_shot': True, 'arguments': None, 'calls': 1}
    2017-03-10 16:00:23 [pika.callback] DEBUG: Added: {'callback': >, 'only': None, 'one_shot': True, 'arguments': None, 'calls': 1}
    INFO:pika.adapters.base_connection:Connecting to rabbitmqSever:5672 with SSL
    2017-03-10 16:00:23 [pika.adapters.base_connection] INFO: Connecting to rabbitmqSever:5672 with SSL
    WARNING:pika.adapters.base_connection:Connection to rabbitmqSever:5672 failed: [Errno 336265218] _ssl.c:355: error:140B0002:SSL routines:SSL_CTX_use_PrivateKey_file:system lib
    2017-03-10 16:00:23 [pika.adapters.base_connection] WARNING: Connection to rabbitmqSever:5672 failed: [Errno 336265218] _ssl.c:355: error:140B0002:SSL routines:SSL_CTX_use_PrivateKey_file:system lib
    WARNING:pika.connection:Could not connect, 0 attempts left
    2017-03-10 16:00:23 [pika.connection] WARNING: Could not connect, 0 attempts left
    DEBUG:pika.callback:Processing 0:_on_connection_error
    2017-03-10 16:00:23 [pika.callback] DEBUG: Processing 0:_on_connection_error
    DEBUG:pika.callback:Calling > for "0:_on_connection_error"
    2017-03-10 16:00:23 [pika.callback] DEBUG: Calling > for "0:_on_connection_error"
    Unhandled error in Deferred:
    CRITICAL:twisted:Unhandled error in Deferred:
    2017-03-10 16:00:23 [twisted] CRITICAL: Unhandled error in Deferred:</p>
  </blockquote>
  
  <p><strong>Update</strong>:</p>
  
  <p>If I use <code>openssl</code> to connect:</p>
  
  <pre><code>openssl s_client -connect server:5671 -cert client_certificate.pem -key client_key.pem
  </code></pre>
  
  <p>I get the following:</p>
  
  <p><code>CONNECTED(00000003)
  140243320723104:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:795:
  no peer certificate available
  No client certificate CA names sent
  SSL handshake has read 7 bytes and written 295 bytes
  New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE</code></p>
  
  <p>And rabbitmq logs show a connection but from the ssl port 5672, it says connect refused.</p>
  
  <p>Please note: I am connecting to rabbitmq from a <code>scrapy spider</code></p>