SSL connection not taking place with RabbitMQ

[klohanik]

While working on a issue found that SSL connection are not created when interacting to RabbitMQ. There is following exception that occurs:

Exception

Starting application. . . .
RabbitMQ.Client.Exceptions.BrokerUnreachableException: None of the specified endpoints were reachable ---> System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: One or more of the parameters passed to the function was invalid
   --- End of inner exception stack trace ---
   at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
   at RabbitMQ.Client.SslHelper.TcpUpgrade(Stream tcpStream, SslOption sslOption)
   at RabbitMQ.Client.Impl.SocketFrameHandler..ctor(AmqpTcpEndpoint endpoint, Func`2 socketFactory, Int32 connectionTimeout, Int32 readTimeout, Int32 writeTimeout)
   at RabbitMQ.Client.Framing.Impl.ProtocolBase.CreateFrameHandler(AmqpTcpEndpoint endpoint, Func`2 socketFactory, Int32 connectionTimeout, Int32 readTimeout, Int32 writeTimeout)
   at RabbitMQ.Client.ConnectionFactory.CreateFrameHandler(AmqpTcpEndpoint endpoint)
   at RabbitMQ.Client.ConnectionFactory.CreateConnection(IList`1 endpoints, String clientProvidedName)
   --- End of inner exception stack trace ---
   at RabbitMQ.Client.ConnectionFactory.CreateConnection(IList`1 endpoints, String clientProvidedName)
   at RabbitMQ.Client.ConnectionFactory.CreateConnection(IList`1 hostnames, String clientProvidedName)
   at RabbitMQ.Client.ConnectionFactory.CreateConnection()

Code snippet

namespace ConsoleApp_Test
{
    class Program
    {
        private static string certificatepath = @"C:\CertificatePath\4RMQClientCert.p12";
        static void Main(string[] args)
        {
            try
            {
                Console.WriteLine("Starting application. . . . ");
                ConnectionFactory connectionFactory = CreateConnectionFactory();
                IConnection connection = connectionFactory.CreateConnection();
                Console.ReadLine();
                Console.WriteLine("Connection Created successfully . . .");
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex);
                CreateErrorTextFile(ex.StackTrace);
            }
            finally
            {
                Console.ReadLine();
            }
        }

        private static ConnectionFactory CreateConnectionFactory()
        {
            XmlDocument xml = new XmlDocument();
            xml.Load(@"TLSParameters.xml");
            XmlNodeList parameters = xml.SelectNodes("Parameters");
            ConnectionFactory connectionFactory = new ConnectionFactory();
            foreach (XmlNode xnlNode in parameters)
            {
                XmlElement element = (XmlElement)xnlNode;
                connectionFactory.HostName = element.GetElementsByTagName("HostName")[0].ChildNodes[0].InnerText;
                connectionFactory.UserName = element.GetElementsByTagName("UserName")[0].ChildNodes[0].InnerText;
                connectionFactory.Password = element.GetElementsByTagName("Password")[0].ChildNodes[0].InnerText;
                connectionFactory.Ssl.CertPath = element.GetElementsByTagName("ClientCertPath")[0].ChildNodes[0].InnerText;
                connectionFactory.Ssl.CertPassphrase = element.GetElementsByTagName("CertificatePassword")[0].ChildNodes[0].InnerText;
                connectionFactory.Ssl.ServerName = element.GetElementsByTagName("ServerName")[0].ChildNodes[0].InnerText;
            }

            connectionFactory.Ssl.Enabled = true;
            connectionFactory.Ssl.Version = SslProtocols.Tls12; // Error in wireshark . No Client hello
            connectionFactory.Ssl.CertificateValidationCallback += new RemoteCertificateValidationCallback(ValidateServerCertificate);
            return connectionFactory;
        }

        private static X509Certificate SelectLocalCertificate(object sender, string targetHost, X509CertificateCollection localCertificates, X509Certificate remoteCertificate, string[] acceptableIssuers)
        {
            Console.WriteLine("Client is selecting a local certificate.");
            if (acceptableIssuers != null &&
                acceptableIssuers.Length > 0 &&
                localCertificates != null &&
                localCertificates.Count > 0)
            {
                // Use the first certificate that is from an acceptable issuer.
                foreach (X509Certificate certificate in localCertificates)
                {
                    string issuer = certificate.Issuer;
                    if (Array.IndexOf(acceptableIssuers, issuer) != -1)
                        return certificate;
                }
            }
            if (localCertificates != null &&
                localCertificates.Count > 0)
                return localCertificates[0];

            return null;
        }

        private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
        {
            bool isServerVerified = false;
            if ((sslPolicyErrors & ~SslPolicyErrors.RemoteCertificateNameMismatch) == SslPolicyErrors.None)
            {
                isServerVerified = true;
            }
            string sslError = sslPolicyErrors.ToString();
            CreateErrorTextFile(sslError);
            Console.WriteLine("Error:" + sslError);
            return isServerVerified;
        }

        private static void CreateErrorTextFile(string error)
        {
            string fileName = @"C:\Temp\SSLErrors.txt";
            using (FileStream fs = File.Create(fileName))
            {
                byte[] errors = new UTF8Encoding(true).GetBytes(error);
                fs.Write(errors, 0, errors.Length);
            }
        }
    }
}

Wireshark capture shows this:

As per my investigation proper wireshark capture should look like following:

Tried many things but none worked.
Steps taken to resolve this :

1. Ran IISCrypto
2. Certificates checked and are latest and have no problem according to me.
3. Verified TLS 1.2 is enabled or not, but it was enabled
4. Working on all other system, other than server machine.
5. Windows is updated to the latest.
6. Firewalls are also disabled.

Please let me know how can I make this hand shake successful so that application interacts successfully with RabbitMQ

[michaelklishin]

There is one key column missing in your Wireshark screenshots: the port. If you try to connect to a non-TLS enabled port with a TLS client, of vice versa, the connection will hang and fail or fail immediately.

See RabbitMQ Ports.

[klohanik]

Trying to make connection to localhost:15671

[lukebakken]

We need more information to be able to assist you:

• What version of RabbitMQ and Erlang are you using?
• What operating system and version is running RabbitMQ?
• What operating system is running your client application? I'm assuming Windows.
• Please ATTACH your complete RabbitMQ configuration files as well as log files. Do NOT paste the files into your response.

[klohanik]

Hi, Please find answers below:

• Version of RabbitMq and Erlang : RabbitMQ 3.8.14 and Erlang 23.2
• Operating system running RabbitMQ : Windows 10
• Operating system running Client App : Windows 10
• Please find RabbitMQ config file attached.
  advanced.config.txt

[lukebakken]

Please attach your log files.

[klohanik]

Please find RabbitMQ log file attached
[email protected]

[lukebakken]

The connections from your application appear to NOT be making it to RabbitMQ as there is nothing logged with regard to connections.

Your advanced.config specifies port 5671 for TLS, but your code snippet does not set the port, which means it's using port 5672. My guess is that is the issue. You need to update your code to use port 5671

[michaelklishin]

We should also mention that RabbitMQ 3.8 is entirely out of support and by Jan 31st, 2023, so will be 3.9.x. Please move to 3.11.