Need help in SSL Enable

[robodevchampion]

Hi, As I got input from security team, I am trying to setup rabbitmq on SSL, for that first I have tried with self signed certificate and it started to work.
Now I am trying with organization actual certificate but some how I am not able to get it work,

Certificate looks like below : 1 is key file in key format
1 is certificate file in crt format that has following blocks ->

-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

now can you please help me what exactly i have to pass in rabbitmq configuration

ssl_options.cacertfile = filename
ssl_options.certfile   = filename
ssl_options.keyfile    = filename

Following is script I am using to connect, whatever i pass I get same error "Unable to get local issuer certificate"

import os
import ssl


class Publisher:
    def __init__(self):
        self.rabbitmq_host = 'queue.orgname.com'
        self.rabbitmq_port = 5671
        self.rabbitmq_username = 'username'
        self.rabbitmq_password = 'pw'
        self.connection = None
        self.channel = None

        self.connect()

    def connect(self):
        credentials = pika.PlainCredentials(self.rabbitmq_username, self.rabbitmq_password)
        ssl_context = ssl.create_default_context()
        ssl_context.load_cert_chain(certfile='path to ca certificate file')
        #ssl_context.options = ssl.OP_NO_TLSv1_2  # optional, to disable older TLS versions
        #ssl_context.verify_mode = ssl.CERT_REQUIRED
        #ssl_context.check_hostname = False
        #ssl_context.verify_mode = ssl.CERT_NONE
        parameters = pika.ConnectionParameters(self.rabbitmq_host, self.rabbitmq_port, '/', credentials, ssl_options=pika.>
        self.connection = pika.BlockingConnection(parameters)
        self.channel = self.connection.channel()
def publish(self, queue, payload):
        print(queue)
        try:
            properties = pika.BasicProperties(delivery_mode=2)
            self.channel.basic_publish(exchange='', routing_key=queue, body=payload, properties=properties)
        except Exception as e:
            print(f"Couldn't publish {e}")

    def close_connection(self):
        if self.connection.is_open:
            self.connection.close()


if __name__ == "__main__":
    p = Publisher()
    print(p.channel)
    p.publish('queuename', "hello world")

Ps : Above certificate i am using with nginx it is working as expected

Please help.

Thanks

[lukebakken]

https://www.rabbitmq.com/docs/ssl

https://www.rabbitmq.com/docs/troubleshooting-ssl

[robodevchampion]

Hi @lukebakken, Thanks for your response, I tried to follow the troubleshooting guide, section ->Use OpenSSL Tools to Test TLS Connections

openssl s_server -accept 8443 -cert server.pem -key key.pem -CAfile cacert.pem
openssl s_client -connect localhost:8443 -cert cacert.pem -key key.pem -CAfile cacert.pem -verify 8 -verify_hostname queue.xyz.com

above commands give same error :

verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = *****, L = *****, O = **********, CN = *.xyz.com
verify error:num=21:unable to verify the first certificate

Can you please suggest what could be the cause/next step.

Thanks

[lukebakken]

At this time, Team RabbitMQ has decided that we do not have the time and resources to answer TLS / X509 certificate related questions such as yours (link to community support policy).

The internet is literally full of RabbitMQ-specific examples for setting up TLS, and general guidance with openssl and X509 certificates.

https://www.google.com/search?q=%22unable+to+verify+the+first+certificate%22

[michaelklishin]

Googling for "unable to get local issuer certificate" contains no shortage of forum discussions and even videos with that exact title.

I know, googling is super hard and Team RabbitMQ ideally should do it for everyone for free. But we have decided to spend our time improving RabbitMQ instead unless you pay or regularly contribute.