RMQ running with SSL, but clients unable to connect

[isanas]

I have enabled SSL in RabbitMQ server. I see that the service is listening on port 5671. But clients are not able to connect to it. If I disable SSL, clients are able to connect. Even the management interface (both ssl / non ssl) do not work when I enable SSL on port 5671.

The certificate used is signed by an internal CA. And the CA cert includes Root and Intermediate.

I tried the troubleshooting steps mentioned in https://www.rabbitmq.com/troubleshooting-ssl.html#verify-tls-support-in-erlang

Noticed that the ssl:versions command does not work from rabbitmqctl but works when I try from erlang shell

Rabbitmqctl:

C:\Program Files\RabbitMQ Server\rabbitmq_server-3.12.8\sbin>rabbitmq-diagnostics --silent tls_versions
tlsv1.3tlsv1.2tlsv1.1tlsv1

C:\Program Files\RabbitMQ Server\rabbitmq_server-3.12.8\sbin>rabbitmqctl.bat eval 'ssl:versions().'
Error (argument validation): "syntax error before: "
Arguments given:
        eval 'ssl:versions().'

Usage

rabbitmqctl [--node <node>] [--longnames] [--quiet] eval <expression>

Erlang:

Eshell V14.1.1 (press Ctrl+G to abort, type help(). for help)
1> ssl:versions().
[{ssl_app,"11.0.3"},
 {supported,['tlsv1.3','tlsv1.2']},
 {supported_dtls,['dtlsv1.2']},
 {available,['tlsv1.3','tlsv1.2','tlsv1.1',tlsv1]},
 {available_dtls,['dtlsv1.2',dtlsv1]},
 {implemented,['tlsv1.3','tlsv1.2','tlsv1.1',tlsv1]},
 {implemented_dtls,['dtlsv1.2',dtlsv1]}]
2>

Below is the config which I have:

# logging to file and/or to an exchange
log.dir = C:\\RabbitMq\\log
log.file = rabbit.log
log.file.level = info

listeners.ssl.default = 5671
ssl_options.versions.1 = tlsv1.3
ssl_options.versions.2 = tlsv1.2
ssl_options.verify = verify_peer
ssl_options.fail_if_no_peer_cert = false
ssl_options.cacertfile = C:\\RabbitMq\\ca.pem
ssl_options.certfile = C:\\RabbitMq\\cert.pem
ssl_options.keyfile = C:\\RabbitMq\\cert_key.pem
ssl_options.depth  = 2

[michaelklishin]

Troubleshooting Networking and Troubleshooting TLS are two doc guides that explain the methodology our team uses to troubleshoot such connectivity issues.

Except for paying customers, we don't have the resources to hand hold you through the process.

Noticed that the ssl:versions command does not work from rabbitmqctl but works when I try from erlang shell

yes, it does work, but likely needs different escaping on Windows.

[michaelklishin]

Inspecting server logs is a very good idea, too, since all TLS alerts from the server will be logged there.

[isanas]

Thanks for the suggestions

I do not see any errors or issues in the rabbitmq logs. I even tried enabling debug logs. I don't see any logs when the connection from client fails. And even while starting rabbitmq, it starts fine.

I even tried configuring different logs as below.

log.dir = C:\\RabbitMq\\log
log.file = rabbit.log
log.file.level = info
log.exchange = true
log.exchange.level = error
log.file.rotation.count = 5
log.file.rotation.size = 10485760
log.connection.level = debug
log.connection.file = rabbit-connection.log
log.channel.level = info
log.channel.file = rabbit-channel.log
log.queue.level = info
log.queue.file = rabbit-channel.log
log.federation.file = rabbit_federation.log
log.federation.level = info

[michaelklishin]

You don't need to set every category individually, neither to enable debug logging nor in general in 99% of cases.

Anyhow, this and this are the only two Logging guide sections you need here.

If there is nothing logged even at debug level, it means that no TCP connections are accepted by the node, or they send no data at all. Which is exactly why Troubleshooting Networking was recommended alongside the TLS-specific guide

[lukebakken]

@isanas -

Noticed that the ssl:versions command does not work from rabbitmqctl but works when I try from erlang shell

You're probably using cmd.exe, which means you must use different quotes when running commands:

rabbitmqctl.bat eval "ssl:versions()."