Windows: need help with an encrypted private key password in advanced.config

[boney96]

Hi Team,

Within ssl_options if I specify password directly, our application is able to establish connection successfully with rabbitMQ.
Now we used rabbitmqctl to encrypt the password and specified the encrypted password as per below. Post that our application is unable to connect with RabbitMQ.
Could you please review advanced.config file?
Note: I have put certificates as #####

advanced.config

[
  {rabbit, [
      {tcp_listeners, [          {'127.0.0.1', 5672}]},
      {ssl_listeners, [5671]},
      {auth_mechanisms, [
'EXTERNAL',
'PLAIN'
        ]},
      {ssl_cert_login_from, common_name},
      {ssl_options, [
          {cacertfile, "######"},
          {certfile, "######"},
          {keyfile, "######"},
		  {password, "{encrypted,<<""5oQdYKuunuwOgfmoFISd6A+S1eVSAfsPRrEOMmNx8C18hxK4PVBhawYxCHvWleqV9a4FzETawyrzrKOm0VYN+VoIrwrRyhWp4fazfsrrcy7YSgjCjEHIpYgJjvViM8vsZfHoc8riK1qInWCom4Yb1w=="">>}"},
          {verify, verify_peer},
          {fail_if_no_peer_cert, true}
        ]},
      {log, [
          {file, [
              {file, "rabbitmq.log"},
              {level, info},
              {date, "$D0"},
              {count, 60}
            ]}
        ]},
      {config_entry_decoder, [
          {passphrase, "passphrase"},
          {cipher, aes_256_cbc},
          {hash, sha512},
          {iterations, 1000}
        ]}
    ]},
  {rabbitmq_management, [
      {listener, [
          {port, 15672},
          {ip, "127.0.0.1"}
        ]}
    ]}
].

Exception Details

C# stack trace

RabbitMQ.Client.Exceptions.BrokerUnreachableException: None of the specified endpoints were reachable
       ---> System.AggregateException: One or more errors occurred. (Unable to write data to the transport connection: An existing connection was forcibly closed by the remote host..)
       ---> System.IO.IOException: Unable to write data to the transport connection: An existing connection was forcibly closed by the remote host..
       ---> System.Net.Sockets.SocketException (10054): An existing connection was forcibly closed by the remote host.
         at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.CreateException(SocketError error, Boolean forAsyncThrow)
         at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.SendAsyncForNetworkStream(Socket socket, CancellationToken cancellationToken)
         at System.Net.Sockets.Socket.SendAsyncForNetworkStream(ReadOnlyMemory`1 buffer, SocketFlags socketFlags, CancellationToken cancellationToken)
         at System.Net.Sockets.NetworkStream.WriteAsync(ReadOnlyMemory`1 buffer, CancellationToken cancellationToken)
         at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
         at System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[TStateMachine](TStateMachine& stateMachine)
         at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
         at System.Net.Security.SslStream.ProcessAuthenticationAsync(Boolean isAsync, Boolean isApm, CancellationToken cancellationToken)
         at System.Net.Security.SslStream.AuthenticateAsClientAsync(SslClientAuthenticationOptions sslClientAuthenticationOptions, CancellationToken cancellationToken)
         at System.Net.Security.SslStream.AuthenticateAsClientAsync(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
         at RabbitMQ.Client.Impl.SslHelper.<>c__DisplayClass2_0.<TcpUpgrade>b__0(SslOption opts)
         at RabbitMQ.Client.Impl.SslHelper.TcpUpgrade(Stream tcpStream, SslOption options)
         at RabbitMQ.Client.Impl.SocketFrameHandler..ctor(AmqpTcpEndpoint endpoint, Func`2 socketFactory, TimeSpan connectionTimeout, TimeSpan readTimeout, TimeSpan writeTimeout)
         at RabbitMQ.Client.ConnectionFactory.CreateFrameHandler(AmqpTcpEndpoint endpoint)
         at RabbitMQ.Client.EndpointResolverExtensions.SelectOne[T](IEndpointResolver resolver, Func`2 selector)
         at RabbitMQ.Client.Framing.Impl.AutorecoveringConnection.Init(IEndpointResolver endpoints)
         at RabbitMQ.Client.ConnectionFactory.CreateConnection(IEndpointResolver endpointResolver, String clientProvidedName)
         at RabbitMQ.Client.ConnectionFactory.CreateConnection(String clientProvidedName)
         at RabbitMQ.Client.ConnectionFactory.CreateConnection()

[lukebakken]

{password, "{encrypted,<<""5oQdYKuunuwOgfmoFISd6A+S1eVSAfsPRrEOMmNx8C18hxK4PVBhawYxCHvWleqV9a4FzETawyrzrKOm0VYN+VoIrwrRyhWp4fazfsrrcy7YSgjCjEHIpYgJjvViM8vsZfHoc8riK1qInWCom4Yb1w=="">>}"},

Remove the outer double quotes:

{password, {encrypted,<<"5oQdYKuunuwOgfmoFISd6A+S1eVSAfsPRrEOMmNx8C18hxK4PVBhawYxCHvWleqV9a4FzETawyrzrKOm0VYN+VoIrwrRyhWp4fazfsrrcy7YSgjCjEHIpYgJjvViM8vsZfHoc8riK1qInWCom4Yb1w==">>}},

[boney96]

Our environment is windows, so if I remove the outer double quotes, rabbitMQ gets shut down automatically.

[lukebakken]

The advanced.config file you have provided is not formatted correctly. The extra quotes are one error, and there probably are others.

Please do what I ask, then run rabbitmq-server.bat in the shell. Copy all of the output, and attach your log file.

[lukebakken]

Please also provide the full command you used to encrypt the password, and what shell is used (cmd or PS)

[lukebakken]

@boney96 I have provided a complete, working example that I have tested on Windows 11:

https://github.com/lukebakken/mqtt-client-cert-example/tree/win32-advanced.config

Carefully review the following:

• Encrypting the passphrase: https://github.com/lukebakken/mqtt-client-cert-example/tree/win32-advanced.config
• Encrypted value in advanced.config: https://github.com/lukebakken/mqtt-client-cert-example/blob/win32-advanced.config/advanced.config.in#L15

Note that the above took about an hour of my time to modify from my Linux example (main branch).

[R1zwan]

Thank you @lukebakken. The time and effort is really appreciated. I was able to resolve the issue with the above solution.

[lukebakken]

Great. Would you mind sharing what the issue was so that other people may learn from it?

[R1zwan]

In windows when you encrypt the password as explained in [RabbitMQ forum] (https://www.rabbitmq.com/docs/configure#configuration-encryption-encode-value). The encrypted value was saved without double quotes. Thus, when RabbitMQ tries to decrypt the value, it expects value as string. Which was causing error. When the password was encrypted with double quotes (as string) the issue got resolved.

[lukebakken]

Thank you for the follow-up!