SSL connection not taking place with RabbitMQ - ssl

Question

While working on a issue found that SSL connection are not created when interacting to RabbitMQ. There is following exception that occurs:
Starting application. . . .
RabbitMQ.Client.Exceptions.BrokerUnreachableException: None of the specified endpoints were reachable ---> System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: One or more of the parameters passed to the function was invalid
--- End of inner exception stack trace ---
at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
at RabbitMQ.Client.SslHelper.TcpUpgrade(Stream tcpStream, SslOption sslOption)
at RabbitMQ.Client.Impl.SocketFrameHandler..ctor(AmqpTcpEndpoint endpoint, Func2 socketFactory, Int32 connectionTimeout, Int32 readTimeout, Int32 writeTimeout) at RabbitMQ.Client.Framing.Impl.ProtocolBase.CreateFrameHandler(AmqpTcpEndpoint endpoint, Func2 socketFactory, Int32 connectionTimeout, Int32 readTimeout, Int32 writeTimeout)
at RabbitMQ.Client.ConnectionFactory.CreateFrameHandler(AmqpTcpEndpoint endpoint)
at RabbitMQ.Client.ConnectionFactory.CreateConnection(IList1 endpoints, String clientProvidedName) --- End of inner exception stack trace --- at RabbitMQ.Client.ConnectionFactory.CreateConnection(IList1 endpoints, String clientProvidedName)
at RabbitMQ.Client.ConnectionFactory.CreateConnection(IList`1 hostnames, String clientProvidedName)
at RabbitMQ.Client.ConnectionFactory.CreateConnection()
Here is the code snippet:
`
namespace ConsoleApp_Test
{
class Program
{
private static string certificatepath = #"C:\CertificatePath\4RMQClientCert.p12";
static void Main(string[] args)
{
try
{
Console.WriteLine("Starting application. . . . ");
ConnectionFactory connectionFactory = CreateConnectionFactory();
IConnection connection = connectionFactory.CreateConnection();
Console.ReadLine();
Console.WriteLine("Connection Created successfully . . .");
}
catch (Exception ex)
{
Console.WriteLine(ex);
CreateErrorTextFile(ex.StackTrace);
}
finally
{
Console.ReadLine();
}
}
private static ConnectionFactory CreateConnectionFactory()
{
XmlDocument xml = new XmlDocument();
xml.Load(#"TLSParameters.xml");
XmlNodeList parameters = xml.SelectNodes("Parameters");
ConnectionFactory connectionFactory = new ConnectionFactory();
foreach (XmlNode xnlNode in parameters)
{
XmlElement element = (XmlElement)xnlNode;
connectionFactory.HostName = element.GetElementsByTagName("HostName")[0].ChildNodes[0].InnerText;
connectionFactory.UserName = element.GetElementsByTagName("UserName")[0].ChildNodes[0].InnerText;
connectionFactory.Password = element.GetElementsByTagName("Password")[0].ChildNodes[0].InnerText;
connectionFactory.Ssl.CertPath = element.GetElementsByTagName("ClientCertPath")[0].ChildNodes[0].InnerText;
connectionFactory.Ssl.CertPassphrase = element.GetElementsByTagName("CertificatePassword")[0].ChildNodes[0].InnerText;
connectionFactory.Ssl.ServerName = element.GetElementsByTagName("ServerName")[0].ChildNodes[0].InnerText;
}
connectionFactory.Ssl.Enabled = true;
connectionFactory.Ssl.Version = SslProtocols.Tls12; // Error in wireshark . No Client hello
connectionFactory.Ssl.CertificateValidationCallback += new RemoteCertificateValidationCallback(ValidateServerCertificate);
return connectionFactory;
}
private static X509Certificate SelectLocalCertificate(object sender, string targetHost, X509CertificateCollection localCertificates, X509Certificate remoteCertificate, string[] acceptableIssuers)
{
Console.WriteLine("Client is selecting a local certificate.");
if (acceptableIssuers != null &&
acceptableIssuers.Length > 0 &&
localCertificates != null &&
localCertificates.Count > 0)
{
// Use the first certificate that is from an acceptable issuer.
foreach (X509Certificate certificate in localCertificates)
{
string issuer = certificate.Issuer;
if (Array.IndexOf(acceptableIssuers, issuer) != -1)
return certificate;
}
}
if (localCertificates != null &&
localCertificates.Count > 0)
return localCertificates[0];
return null;
}
private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
bool isServerVerified = false;
if ((sslPolicyErrors & ~SslPolicyErrors.RemoteCertificateNameMismatch) == SslPolicyErrors.None)
{
isServerVerified = true;
}
string sslError = sslPolicyErrors.ToString();
CreateErrorTextFile(sslError);
Console.WriteLine("Error:" + sslError);
return isServerVerified;
}
private static void CreateErrorTextFile(string error)
{
string fileName = #"C:\Temp\SSLErrors.txt";
using (FileStream fs = File.Create(fileName))
{
byte[] errors = new UTF8Encoding(true).GetBytes(error);
fs.Write(errors, 0, errors.Length);
}
}
}
}
`
Wireshark capture shows this:
enter image description here
As per my investigation proper wireshark capture should look like following:
enter image description here
Tried many things but none worked.
Steps taken to resolve this :
Ran IISCrypto
Certificates checked and are latest and have no problem according to me.
Verified TLS 1.2 is enabled or not, but it was enabled
Working on all other system, other than server machine.
Windows is updated to the latest.
Firewalls are also disabled.
Please let me know how can I make this hand shake successful so that application interacts successfully with RabbitMQ
Ran IISCrypto
Certificates checked and are latest and have no problem according to me.
Verified TLS 1.2 is enabled or not, but it was enabled
Working on all other system, other than server machine.
Windows is updated to the latest.
Firewalls are also disabled.
Please let me know how can I make this hand shake successful so that application interacts successfully with RabbitMQ