Impossible to use SSL connections #477

galzetta · 2021-03-26T16:22:40Z

galzetta
Mar 26, 2021

I'm trying to run a RabbitMQ Pod with SSL on a Kubernetes cluster.

I define the env variables:

- name: RABBITMQ_MANAGEMENT_SSL_CACERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_MANAGEMENT_SSL_CERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_MANAGEMENT_SSL_KEYFILE
  value: /certs/rabbit_cert.key
- name: RABBITMQ_SSL_CACERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_SSL_CERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_SSL_KEYFILE
  value: /certs/rabbit_cert.key

(obviously a test setup)

In the logs I see that the listeners for SSL do start:

2021-03-26 15:47:25.475 [info] <0.44.0> Application cowlib started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.476 [info] <0.44.0> Application cowboy started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.477 [info] <0.44.0> Application rabbitmq_web_dispatch started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.478 [info] <0.44.0> Application amqp_client started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.589 [info] <0.812.0> Management plugin: HTTPS listener started on port 15671
2021-03-26 15:47:25.590 [info] <0.920.0> Statistics database started.
2021-03-26 15:47:25.590 [info] <0.919.0> Starting worker pool 'management_worker_pool' with 3 processes in it
2021-03-26 15:47:25.593 [info] <0.44.0> Application rabbitmq_management started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.675 [info] <0.44.0> Application prometheus started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.691 [info] <0.933.0> Prometheus metrics: HTTP (non-TLS) listener started on port 15692
2021-03-26 15:47:25.693 [info] <0.44.0> Application rabbitmq_prometheus started on node 'rabbit@rabbitmq-a'
2021-03-26 15:47:25.692 [info] <0.753.0> Ready to start client connection listeners
2021-03-26 15:47:25.700 [info] <0.1052.0> started TCP listener on [::]:5672
2021-03-26 15:47:25.705 [info] <0.1069.0> started TLS (SSL) listener on [::]:5671
2021-03-26 15:47:28.703 [info] <0.753.0> Server startup complete; 4 plugins started.

Unfortunately if I do rabbitmq-diagnostics status it gives an error:

Error: unable to perform an operation on node 'rabbit@rabbitmq-a'. Please see diagnostics information and suggestions below.

Most common reasons for this are:

 * Target node is unreachable (e.g. due to hostname resolution, TCP connection or firewall issues)
 * CLI tool fails to authenticate with the server (e.g. due to CLI tool's Erlang cookie not matching that of the server)
 * Target node is not running

In addition to the diagnostics info below:

 * See the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more
 * Consult server logs on node rabbit@rabbitmq-a
 * If target node is configured to use long node names, don't forget to use --longnames with CLI tools

DIAGNOSTICS
===========

attempted to contact: ['rabbit@rabbitmq-a']

rabbit@rabbitmq-a:
  * connected to epmd (port 4369) on rabbitmq-a
  * epmd reports: node 'rabbit' not running at all
                  other nodes on rabbitmq-a: ['rabbitmqcli-415-rabbit']
  * suggestion: start the node

Current node details:
 * node name: 'rabbitmqcli-481-rabbit@rabbitmq-a'
 * effective user's home directory: /var/lib/rabbitmq
 * Erlang cookie hash:<some hash>

Starting the container without SSL works fine and rabbitmq-diagnostics status returns the correct output without errors.

Note that this is a single container, so there is no cluster, no possible problem with multiple nodes being out of sync etc.

Running netstat -tulpn inside the container I see that the listeners are active (although I don't understand why some ports are bound to localhost and other to 0.0.0.0...):

# netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:25672           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:15692           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:4369            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:15671           0.0.0.0:*               LISTEN      -
tcp        0      0 :::5671                 :::*                    LISTEN      -
tcp        0      0 :::5672                 :::*                    LISTEN      -
tcp        0      0 :::4369                 :::*                    LISTEN      -

If I try to telnet 127.0.0.1 5671 it connects (with 5672 too).

Here are the logs:
logs-from-rabbitmq-a-in-rabbitmq-a.txt

Is this a bug in the docker image or a problem on how SSL is configured. The docker Hub page simply says to use the env variables without any information and I tried to follow a couple of online guides to generate the correct certificates and IMHO if the listeners start that should mean Rabbit liked the certificates, right?

I forgot to mention, my application using Micronaut fails to connect with this error:

Caused by: io.micronaut.messaging.exceptions.MessageListenerException: Failed to retrieve a channel pool named [default] to register a listener
	at io.micronaut.rabbitmq.intercept.RabbitMQConsumerAdvice.process(RabbitMQConsumerAdvice.java:124)
	at io.micronaut.rabbitmq.intercept.RabbitMQConsumerAdvice.process(RabbitMQConsumerAdvice.java:67)
	at io.micronaut.context.AnnotationProcessorListener.onCreated(AnnotationProcessorListener.java:95)
	... 15 common frames omitted
Caused by: io.micronaut.context.exceptions.BeanInstantiationException: Error creating connection to RabbitMQ
	at io.micronaut.rabbitmq.connect.RabbitConnectionFactory.connection(RabbitConnectionFactory.java:62)
	at io.micronaut.rabbitmq.connect.$RabbitConnectionFactory$Connection0Definition.build(Unknown Source)
	at io.micronaut.context.BeanDefinitionDelegate.build(BeanDefinitionDelegate.java:153)
	at io.micronaut.context.DefaultBeanContext.doCreateBean(DefaultBeanContext.java:1943)
	at io.micronaut.context.DefaultBeanContext.createAndRegisterSingletonInternal(DefaultBeanContext.java:2724)
	at io.micronaut.context.DefaultBeanContext.createAndRegisterSingleton(DefaultBeanContext.java:2710)
	at io.micronaut.context.DefaultBeanContext.getBeanForDefinition(DefaultBeanContext.java:2382)
	at io.micronaut.context.DefaultBeanContext.getBeanInternal(DefaultBeanContext.java:2356)
	at io.micronaut.context.DefaultBeanContext.findBean(DefaultBeanContext.java:1282)
	at io.micronaut.context.DefaultBeanContext.findBean(DefaultBeanContext.java:752)
	at io.micronaut.context.BeanDefinitionDelegate.build(BeanDefinitionDelegate.java:142)
	at io.micronaut.context.DefaultBeanContext.doCreateBean(DefaultBeanContext.java:1943)
	at io.micronaut.context.DefaultBeanContext.createAndRegisterSingletonInternal(DefaultBeanContext.java:2724)
	at io.micronaut.context.DefaultBeanContext.createAndRegisterSingleton(DefaultBeanContext.java:2710)
	at io.micronaut.context.DefaultBeanContext.getBeanForDefinition(DefaultBeanContext.java:2382)
	at io.micronaut.context.DefaultBeanContext.getBeanInternal(DefaultBeanContext.java:2356)
	at io.micronaut.context.DefaultBeanContext.getBean(DefaultBeanContext.java:729)
	at io.micronaut.rabbitmq.intercept.RabbitMQConsumerAdvice.process(RabbitMQConsumerAdvice.java:122)
	... 17 common frames omitted
Caused by: javax.net.ssl.SSLException: readHandshakeRecord
	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl$AppOutputStream.write(Unknown Source)
	at java.base/java.io.BufferedOutputStream.flushBuffer(Unknown Source)
	at java.base/java.io.BufferedOutputStream.flush(Unknown Source)
	at java.base/java.io.DataOutputStream.flush(Unknown Source)
	at com.rabbitmq.client.impl.SocketFrameHandler.sendHeader(SocketFrameHandler.java:160)
	at com.rabbitmq.client.impl.SocketFrameHandler.sendHeader(SocketFrameHandler.java:170)
	at com.rabbitmq.client.impl.AMQConnection.start(AMQConnection.java:314)
	at com.rabbitmq.client.impl.recovery.RecoveryAwareAMQConnectionFactory.newConnection(RecoveryAwareAMQConnectionFactory.java:64)
	at com.rabbitmq.client.impl.recovery.AutorecoveringConnection.init(AutorecoveringConnection.java:156)
	at com.rabbitmq.client.ConnectionFactory.newConnection(ConnectionFactory.java:1130)
	at com.rabbitmq.client.ConnectionFactory.newConnection(ConnectionFactory.java:1087)
	at com.rabbitmq.client.ConnectionFactory.newConnection(ConnectionFactory.java:1045)
	at com.rabbitmq.client.ConnectionFactory.newConnection(ConnectionFactory.java:1238)
	at io.micronaut.rabbitmq.connect.RabbitConnectionFactory.connection(RabbitConnectionFactory.java:59)
	... 34 common frames omitted
	Suppressed: java.net.SocketException: Broken pipe (Write failed)
		at java.base/java.net.SocketOutputStream.socketWrite0(Native Method)
		at java.base/java.net.SocketOutputStream.socketWrite(Unknown Source)
		at java.base/java.net.SocketOutputStream.write(Unknown Source)
		at java.base/sun.security.ssl.SSLSocketOutputRecord.encodeAlert(Unknown Source)
		at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
		at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
		... 50 common frames omitted
Caused by: java.net.SocketException: Connection reset by peer (Write failed)
	at java.base/java.net.SocketOutputStream.socketWrite0(Native Method)
	at java.base/java.net.SocketOutputStream.socketWrite(Unknown Source)
	at java.base/java.net.SocketOutputStream.write(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketOutputRecord.flush(Unknown Source)
	at java.base/sun.security.ssl.HandshakeOutStream.flush(Unknown Source)
	at java.base/sun.security.ssl.ECDHClientKeyExchange$ECDHEClientKeyExchangeProducer.produce(Unknown Source)
	at java.base/sun.security.ssl.ClientKeyExchange$ClientKeyExchangeProducer.produce(Unknown Source)
	at java.base/sun.security.ssl.SSLHandshake.produce(Unknown Source)
	at java.base/sun.security.ssl.ServerHelloDone$ServerHelloDoneConsumer.consume(Unknown Source)
	at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
	at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
	... 51 common frames omitted

So it's not an out-right connection refused.

wglambert · 2021-03-26T16:31:09Z

wglambert
Mar 26, 2021

Half your environment variables are for the management variant and half are for the non-management

https://github.com/docker-library/docs/tree/master/rabbitmq#environment-variables

For SSL configuration without the management plugin:
. . .

For SSL configuration using the management plugin:
. . .

Following the example at https://www.rabbitmq.com/ssl.html#automated-certificate-generation-transcript I was able to get ssl working #376 (comment)
See also #470

2 replies

galzetta Mar 26, 2021
Author

I first tried to use the management ones since I use the management image but it does not work, same with just the others.

Results using only the non-management env vars with the image rabbitmq:3-management-alpine

- name: RABBITMQ_SSL_CACERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_SSL_CERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_SSL_KEYFILE
  value: /certs/rabbit_cert.key

The health checks do not work:

Error: unable to perform an operation on node 'rabbit@rabbitmq-a'. Please see diagnostics information and suggestions below.

Most common reasons for this are:

 * Target node is unreachable (e.g. due to hostname resolution, TCP connection or firewall issues)
 * CLI tool fails to authenticate with the server (e.g. due to CLI tool's Erlang cookie not matching that of the server)
 * Target node is not running

In addition to the diagnostics info below:

 * See the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more
 * Consult server logs on node rabbit@rabbitmq-a
 * If target node is configured to use long node names, don't forget to use --longnames with CLI tools

DIAGNOSTICS
===========

attempted to contact: ['rabbit@rabbitmq-a']

rabbit@rabbitmq-a:
  * connected to epmd (port 4369) on rabbitmq-a
  * epmd reports node 'rabbit' uses port 25672 for inter-node and CLI tool traffic 
  * TCP connection succeeded but Erlang distribution failed 
  * suggestion: check if the Erlang cookie identical for all server nodes and CLI tools
  * suggestion: check if all server nodes and CLI tools use consistent hostnames when addressing each other
  * suggestion: check if inter-node connections may be configured to use TLS. If so, all nodes and CLI tools must do that
   * suggestion: see the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more


Current node details:
 * node name: 'rabbitmqcli-899-rabbit@rabbitmq-a'
 * effective user's home directory: /var/lib/rabbitmq
 * Erlang cookie hash: +uburyyqUW1rZzkJdDeEjg==

bash-5.1# rabbitmqctl status
Error: unable to perform an operation on node 'rabbit@rabbitmq-a'. Please see diagnostics information and suggestions below.

Most common reasons for this are:

 * Target node is unreachable (e.g. due to hostname resolution, TCP connection or firewall issues)
 * CLI tool fails to authenticate with the server (e.g. due to CLI tool's Erlang cookie not matching that of the server)
 * Target node is not running

In addition to the diagnostics info below:

 * See the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more
 * Consult server logs on node rabbit@rabbitmq-a
 * If target node is configured to use long node names, don't forget to use --longnames with CLI tools

DIAGNOSTICS
===========

attempted to contact: ['rabbit@rabbitmq-a']

rabbit@rabbitmq-a:
  * connected to epmd (port 4369) on rabbitmq-a
  * epmd reports node 'rabbit' uses port 25672 for inter-node and CLI tool traffic 
  * TCP connection succeeded but Erlang distribution failed 
  * suggestion: check if the Erlang cookie identical for all server nodes and CLI tools
  * suggestion: check if all server nodes and CLI tools use consistent hostnames when addressing each other
  * suggestion: check if inter-node connections may be configured to use TLS. If so, all nodes and CLI tools must do that
   * suggestion: see the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more


Current node details:
 * node name: 'rabbitmqcli-423-rabbit@rabbitmq-a'
 * effective user's home directory: /var/lib/rabbitmq
 * Erlang cookie hash: +uburyyqUW1rZzkJdDeEjg==

From the logs the listeners seem to start fine:

logs-from-rabbitmq-a-in-rabbitmq-a.txt

Results using onl the management env vars with the image rabbitmq:3-management-alpine:

- name: RABBITMQ_MANAGEMENT_SSL_CACERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_MANAGEMENT_SSL_CERTFILE
  value: /certs/rabbit_cert.pem
- name: RABBITMQ_MANAGEMENT_SSL_KEYFILE
  value: /certs/rabbit_cert.key

RabbitMQ does not listen with SSL on port 5671:

bash-5.1# netstat -tlpun
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:15671           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:25672           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:15692           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:4369            0.0.0.0:*               LISTEN      -
tcp        0      0 :::5672                 :::*                    LISTEN      -
tcp        0      0 :::4369                 :::*                    LISTEN      -

However in this case the health checks do work, although RabbitMQ is not listening in SSL, only the management interface is listening in SSL:

bash-5.1# rabbitmq-diagnostics status
Status of node rabbit@rabbitmq-irp ...
Runtime

OS PID: 407
OS: Linux
Uptime (seconds): 58
Is under maintenance?: false
RabbitMQ version: 3.8.14
Node name: rabbit@rabbitmq-irp
Erlang configuration: Erlang/OTP 23 [erts-11.1.8] [source] [64-bit] [smp:8:1] [ds:8:1:10] [async-threads:1]
Erlang processes: 590 used, 1048576 limit
Scheduler run queue: 1
Cluster heartbeat timeout (net_ticktime): 60

Plugins

Enabled plugin file: /etc/rabbitmq/enabled_plugins
Enabled plugins:

 * rabbitmq_prometheus
 * prometheus
 * rabbitmq_management
 * amqp_client
 * rabbitmq_web_dispatch
 * cowboy
 * cowlib
 * rabbitmq_management_agent

Data directory

Node data directory: /var/lib/rabbitmq/mnesia/rabbit@rabbitmq-irp
Raft data directory: /var/lib/rabbitmq/mnesia/rabbit@rabbitmq-irp/quorum/rabbit@rabbitmq-irp

Config files

 * /etc/rabbitmq/rabbitmq.conf

Log file(s)

 * <stdout>

Alarms

(none)

Memory

Total memory used: 0.1183 gb
Calculation strategy: rss
Memory high watermark setting: 0.4 of available memory, computed to: 0.2147 gb

other_proc: 0.0342 gb (27.7 %)
code: 0.0331 gb (26.84 %)
other_system: 0.0284 gb (22.98 %)
allocated_unused: 0.0127 gb (10.25 %)
plugins: 0.0091 gb (7.35 %)
other_ets: 0.0033 gb (2.67 %)
atom: 0.0015 gb (1.19 %)
binary: 0.0004 gb (0.33 %)
metrics: 0.0002 gb (0.2 %)
mgmt_db: 0.0002 gb (0.14 %)
connection_other: 0.0001 gb (0.11 %)
mnesia: 0.0001 gb (0.08 %)
connection_readers: 0.0001 gb (0.04 %)
quorum_ets: 0.0 gb (0.04 %)
queue_procs: 0.0 gb (0.03 %)
msg_index: 0.0 gb (0.02 %)
connection_channels: 0.0 gb (0.01 %)
connection_writers: 0.0 gb (0.0 %)
queue_slave_procs: 0.0 gb (0.0 %)
quorum_queue_procs: 0.0 gb (0.0 %)
reserved_unallocated: 0.0 gb (0.0 %)

File Descriptors

Total: 4, limit: 1048479
Sockets: 2, limit: 943629

Free Disk Space

Low free disk space watermark: 0.05 gb
Free disk space: 16.0562 gb

Totals

Connection count: 2
Queue count: 2
Virtual host count: 1

Listeners

Interface: [::], port: 15671, protocol: https, purpose: HTTP API over TLS (HTTPS)
Interface: [::], port: 15692, protocol: http/prometheus, purpose: Prometheus exporter API over HTTP
Interface: [::], port: 25672, protocol: clustering, purpose: inter-node and CLI tool communication
Interface: [::], port: 5672, protocol: amqp, purpose: AMQP 0-9-1 and AMQP 1.0
bash-5.1# rabbitmqctl status
Status of node rabbit@rabbitmq-irp ...
Runtime

OS PID: 407
OS: Linux
Uptime (seconds): 81
Is under maintenance?: false
RabbitMQ version: 3.8.14
Node name: rabbit@rabbitmq-irp
Erlang configuration: Erlang/OTP 23 [erts-11.1.8] [source] [64-bit] [smp:8:1] [ds:8:1:10] [async-threads:1]
Erlang processes: 590 used, 1048576 limit
Scheduler run queue: 1
Cluster heartbeat timeout (net_ticktime): 60

Plugins

Enabled plugin file: /etc/rabbitmq/enabled_plugins
Enabled plugins:

 * rabbitmq_prometheus
 * prometheus
 * rabbitmq_management
 * amqp_client
 * rabbitmq_web_dispatch
 * cowboy
 * cowlib
 * rabbitmq_management_agent

Data directory

Node data directory: /var/lib/rabbitmq/mnesia/rabbit@rabbitmq-irp
Raft data directory: /var/lib/rabbitmq/mnesia/rabbit@rabbitmq-irp/quorum/rabbit@rabbitmq-irp

Config files

 * /etc/rabbitmq/rabbitmq.conf

Log file(s)

 * <stdout>

Alarms

(none)

Memory

Total memory used: 0.1145 gb
Calculation strategy: rss
Memory high watermark setting: 0.4 of available memory, computed to: 0.2147 gb

other_proc: 0.0342 gb (27.73 %)
code: 0.0331 gb (26.84 %)
other_system: 0.0284 gb (22.98 %)
allocated_unused: 0.0126 gb (10.2 %)
plugins: 0.0091 gb (7.38 %)
other_ets: 0.0033 gb (2.67 %)
atom: 0.0015 gb (1.19 %)
binary: 0.0004 gb (0.33 %)
metrics: 0.0002 gb (0.2 %)
mgmt_db: 0.0002 gb (0.15 %)
connection_other: 0.0001 gb (0.11 %)
mnesia: 0.0001 gb (0.08 %)
quorum_ets: 0.0 gb (0.04 %)
connection_readers: 0.0 gb (0.04 %)
queue_procs: 0.0 gb (0.03 %)
msg_index: 0.0 gb (0.02 %)
connection_channels: 0.0 gb (0.01 %)
connection_writers: 0.0 gb (0.0 %)
queue_slave_procs: 0.0 gb (0.0 %)
quorum_queue_procs: 0.0 gb (0.0 %)
reserved_unallocated: 0.0 gb (0.0 %)

File Descriptors

Total: 4, limit: 1048479
Sockets: 2, limit: 943629

Free Disk Space

Low free disk space watermark: 0.05 gb
Free disk space: 16.0563 gb

Totals

Connection count: 2
Queue count: 2
Virtual host count: 1

Listeners

Interface: [::], port: 15671, protocol: https, purpose: HTTP API over TLS (HTTPS)
Interface: [::], port: 15692, protocol: http/prometheus, purpose: Prometheus exporter API over HTTP
Interface: [::], port: 25672, protocol: clustering, purpose: inter-node and CLI tool communication
Interface: [::], port: 5672, protocol: amqp, purpose: AMQP 0-9-1 and AMQP 1.0

In this second case my client simply gets a Connection refused, while in the first case it gets a Broken pipe error.

galzetta Mar 26, 2021
Author

In other words all combinations of env variables fails.

yosifkit · 2021-03-26T18:33:07Z

yosifkit
Mar 26, 2021
Maintainer

Did you run rabbitmq-diagnostics status with extra ssl arguments/environment variables like the entrypoint sets up for rabbitmqctl?

rabbitmq/docker-entrypoint.sh

Lines 412 to 415 in 6fde356

    
           export ERL_SSL_PATH="$(erl -eval 'io:format("~p", [code:lib_dir(ssl, ebin)]),halt().' -noshell)" 
        
           sslErlArgs="-pa $ERL_SSL_PATH -proto_dist inet_tls -ssl_dist_opt server_certfile $combinedSsl -ssl_dist_opt server_secure_renegotiate true client_secure_renegotiate true" 
        
           export RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS="${RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS:-} $sslErlArgs" 
        
           export RABBITMQ_CTL_ERL_ARGS="${RABBITMQ_CTL_ERL_ARGS:-} $sslErlArgs"

Or try running it through the entrypoint: docker exec rabbit-container docker-entrypoint.sh rabbitmq-diagnostics status

1 reply

galzetta Mar 29, 2021
Author

Using docker-entrypoint.sh seems to help. Why isn't it mentioned in the DockerHub page? An addition in the section "Health/Liveness/Readiness Checking" of https://hub.docker.com/_/rabbitmq would be helpful.

The other thing that was missing is that I had to specify RABBITMQ_SSL_FAIL_IF_NO_PEER_CERT=false no enable clients without a certificate.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Impossible to use SSL connections #477

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Impossible to use SSL connections #477

Uh oh!

Uh oh!

galzetta Mar 26, 2021

Replies: 2 comments · 3 replies

Uh oh!

wglambert Mar 26, 2021

Uh oh!

galzetta Mar 26, 2021 Author

Uh oh!

galzetta Mar 26, 2021 Author

Uh oh!

yosifkit Mar 26, 2021 Maintainer

Uh oh!

galzetta Mar 29, 2021 Author

galzetta
Mar 26, 2021

Replies: 2 comments 3 replies

wglambert
Mar 26, 2021

galzetta Mar 26, 2021
Author

galzetta Mar 26, 2021
Author

yosifkit
Mar 26, 2021
Maintainer

galzetta Mar 29, 2021
Author