Unexpected Eof using x509 authentication

[HorusRT]

Describe the bug

Hello,
I am trying to setup the client authentication using x509 certificate. The certificate is generated from HashiCorp Vault.
Here is my rabbitmq conf file:

listeners.ssl.default = 5671

ssl_options.cacertfile = /etc/rabbitmq/certs/ca.pem
ssl_options.certfile   = /etc/rabbitmq/certs/server_cert.pem
ssl_options.keyfile    = /etc/rabbitmq/certs/server_key.pem
ssl_options.verify     = verify_peer
ssl_options.fail_if_no_peer_cert = true

management.listener.port = 15672
management.listener.ssl = false
loopback_users.guest = false
auth_mechanisms.1 = PLAIN
auth_mechanisms.2 = AMQPLAIN
auth_mechanisms.3 = EXTERNAL

I deploy my rabbitmq through docker docker-compose.yml:

version: '3.6'
services:
  vault:
    image: vault:1.10.3
    container_name: vault
    restart: on-failure:10
    ports:
      - "8201:8201"
    environment:
      VAULT_ADDR: 'https://0.0.0.0:8201'
      VAULT_API_ADDR: 'https://0.0.0.0:8201'
      VAULT_LOCAL_CONFIG: '{"listener": [{"tcp":{"address": "0.0.0.0:8201","tls_disable":"0", "tls_cert_file":"/data/certificate.pem", "tls_key_file":"/data/key.pem"}}], "default_lease_ttl": "168h", "max_lease_ttl": "720h"}, "ui": true}'
      VAULT_DEV_ROOT_TOKEN_ID: SOMETOKEN'
      VAULT_TOKEN: 'SOMETOKEN'
      VAULT_SKIP_VERIFY: "true"
    cap_add:
      - IPC_LOCK
    volumes:
      - ./vault-volume:/data
      - ./vault-init.sh:/root/vault-init.sh
      - ./rabbitmq_ca_cert:/etc/rabbitmq/ssl
    healthcheck:
      retries: 5
    command: /bin/sh -c /root/vault-init.sh
    networks:
      - sk_cloud
  rabbitmq_signum:
    image: rabbitmq:3.8-management
    container_name: rabbitmq
    environment: 
      VAULT_ADDR: "http://localhost:8201"
      VAULT_TOKEN: "SOMETOKEN"
      RABBITMQ_ERLANG_COOKIE: "secret"
      RABBITMQ_USE_LONGNAME: "true"
      RABBITMQ_PLUGINS: ""
    ports:
      - "5672:5672"
      - "15672:15672"
      - "5671:5671"
    volumes:
      - ./certs:/etc/rabbitmq/certs
      - ./rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf
      - ./rabbit_enabled_plugins:/etc/rabbitmq/enabled_plugins
    networks:
      - sk_cloud
    depends_on:
      - vault
volumes:
  vault-volume:
  rabbitmq_data:
  rabbitmq_ca_cert:
networks:
  sk_cloud:

I use rabbitmq with rust via the library lapin here is the sample test I'm doing :

        let uri = "amqps://localhost:5671";
        let cert = body.data.certificate;
        let private_key = body.data.private_key;
        let ca = body.data.issuing_ca;

        let identity = convert_to_pkcs12(&cert, &private_key);

        let config_tls = OwnedTLSConfig {
            identity: Some(OwnedIdentity {
                der: identity.unwrap(),
                password: "somepassword".to_owned(),
            }),
            cert_chain: Some(ca.to_owned()),
        };
        let connection =
            Connection::connect_with_config(uri, ConnectionProperties::default(), config_tls)
                .await
                .unwrap();
        let channel = connection.create_channel().await;

I also tried with classic password :

    async fn test_connect_amqps_with_password() {
        let uri = "amqps://guest:guest@localhost:5671";

        let connection = Connection::connect(uri, ConnectionProperties::default())
            .await
            .expect("Failed to connect to AMQPS with username and password");

        let channel = connection
            .create_channel()
            .await
            .expect("Failed to create channel");
    }

Then I get this error when running the tests :
value: IOError(Kind(UnexpectedEof))

I also tried using openssl s_client -connect localhost:5671 -cert client_cert.pem -key client_key.pem -CAfile ca.pem :

CONNECTED(00000003)
007EC80F9E7F0000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:ssl/record/rec_layer_s3.c:303:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 302 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

I'm struggling with this issue for some days now I read in some places that openssl could be the cause due to a change in openssl 3 but I think I'm missing something here.
I actually think that the isssue is related to rabbitmq due to the various ways I am trying to connect to it, but I am not sure.

Reproduction steps

1. Configure TLS for rabbitmq according to the docs
2. Try to connect using a certificate

Expected behavior

I should be connected to rabbitmq and be able to send messages. I should also see in the UI of rabbitmq a connection.

Additional context

No response

[lukebakken]

Note: Team RabbitMQ only uses GitHub issues once actionable work is discovered, which is why I converted your issue to a discussion.

I actually think that the isssue is related to rabbitmq

Given the fact that there are literally thousands of RabbitMQ installations using TLS, I can be certain the issue lies in your environment.

Team RabbitMQ adopted this policy with regard to free support for users, which excludes free support for TLS issues, unless the user provides a COMPLETE environment that demonstrates the issue. In this case, you are asking us to do a lot of work to get an environment up.

I have the following GitHub repos that demonstrate how to set up TLS with RabbitMQ -

• https://github.com/lukebakken/docker-rabbitmq-cluster/tree/tls
• https://github.com/lukebakken/mqtt-client-cert-example

One or the other should be sufficient to demonstrate the issue in your environment.

[HorusRT]

Yeah I also thought that I was doing something wrong actually, thanks for your help I will take another look at the repos to understand what is missing in my environment.