Encryption of config file does not work

[RenzoBonCentric]

Hi,

I am trying to encrypt the password that is needed for SSL connection in the advanced.config file (Windows server 2022).

Currently I have this config:

_[
{rabbit,
[
{ssl, [{versions, ['tlsv1.2']}]},
{tcp_listeners, [5672]},
{ssl_listeners, [5671]},
{ssl_options, [{cacertfile, "C:/RabbitMQ/certs/myCA.pem"},
{certfile, "C:/RabbitMQ/certs/myCert.pem"},
{keyfile, "C:/RabbitMQ/certs/myKey.key"},
{password, {encrypted,<<"AR9veMl+x0hLP4++6W/DyO914LzNwra3s9x5NZ5SDkr/6jM5vgjswQ==">>}},
{config_entry_decoder, [
{passphrase, {file,"C:/RabbitMQ/confighelper.config"}},
{cipher, blowfish_cfb64},
{hash, sha256},
{iterations, 10000}
]},
{verify, verify_peer},
{fail_if_no_peer_cert, true}]},

	{auth_mechanisms, ['PLAIN', 'EXTERNAL']},
	{ssl_cert_login_from, common_name}
]},
{rabbitmq_management,
[
	{listener, [{port,     15671},
		{ssl,      true},
		{ssl_opts, [{cacertfile, "C:/RabbitMQ/certs/myCA.pem"},
			{certfile,   "C:/RabbitMQ/certs/myCert.pem"},
			{keyfile,	"C:/RabbitMQ/certs/myKey.key"},
			{password, {encrypted,<<"AR9veMl+x0hLP4++6W/DyO914LzNwra3s9x5NZ5SDkr/6jM5vgjswQ==">>}},
			{config_entry_decoder, [
					{passphrase, {file,"C:/RabbitMQ/confighelper.config"}},
					{cipher, blowfish_cfb64},
					{hash, sha256},
					{iterations, 10000}
			 ]},
			{versions, ['tlsv1.2']}
		]}
	]}
]}

]._

I have encoded my password with this command:

rabbitmqctl encode 'k3y2wOz@nl' myPassphrase --cipher blowfish_cfb64 --hash sha256 --iterations 10000*
Encrypting value ...
{encrypted,<<"AR9veMl+x0hLP4++6W/DyO914LzNwra3s9x5NZ5SDkr/6jM5vgjswQ==">>}

When decrypting it via the command prompt it works, however when trying to run the RabbitMQ service it does not work, as the RabbitMQ service won't start. The erl_crash.dump shows:

({application_start_failure,rabbitmq_prelaunch,{{shutdown,{failed_to_start_child,prelaunch,{bad_config_entry_decoder,missing_passphrase}}},{rabbit_prelaunch_app,start,[normal,[]]}}})

Anybody any clues?

[michaelklishin]

missing_passphrase

is reported as the reason. config_entry_encoder is misplaced in your configuration file, it must not be under ssl_opts (but a sibling to listener, so, a top-level key) and it must not be under the rabbitmq_management app but under rabbit.

Like in the doc examples.