use TLS 1.2 to connect securely to RabbitMQ - rabbitmq

Question

I am trying to connect to a RabbitMQ server using TLS1.2 but I can't seem to do it. I have verified that my username and password are working as I can connect to the RabbitMQ web client.
using System;
using System.Net;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Configuration;
using System.Xml;
using System.Xml.Linq;
using System.Xml.XPath;
using RabbitMQ.Client;
using RabbitMQ.Client.Events;
namespace DigitalFulfillmentRabbitMQ
{
public class RabbitMQService
{
public IConnection GetRabbitMqConnection()
{
ConnectionFactory connectionFactory = new ConnectionFactory();
// ServicePointManager.CertificatePolicy = new TrustAllCertificatePolicy();
// connectionFactory.Ssl.CertificateValidationCallback = CheckValidationResult();
System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
connectionFactory.HostName = ConfigurationManager.AppSettings["RabbitMQServer"].ToString();
connectionFactory.VirtualHost = ConfigurationManager.AppSettings["RabbitMQVHOST"].ToString();
connectionFactory.Port = Int32.Parse(ConfigurationManager.AppSettings["RabbitMQPort"].ToString());
connectionFactory.UserName = ConfigurationManager.AppSettings["RabbitMQAccountUserName"].ToString();
connectionFactory.Password = ConfigurationManager.AppSettings["RabbitMQAccountPassword"].ToString();
// connectionFactory.Ssl.ServerName = System.Net.Dns.GetHostName();
connectionFactory.Ssl.ServerName = ConfigurationManager.AppSettings["RabbitMQServer"].ToString();
connectionFactory.Ssl.CertPath = ConfigurationManager.AppSettings["RabbitMQSSLCertPath"].ToString();
// connectionFactory.Ssl.CertPassphrase = ConfigurationManager.AppSettings["RabbitMQSSLCertPassphrase"].ToString();
connectionFactory.Ssl.Enabled = Convert.ToBoolean(ConfigurationManager.AppSettings["RabbitMQSSLIsEnabled"].ToString());
connectionFactory.Ssl.Version = System.Security.Authentication.SslProtocols.Tls12;
return connectionFactory.CreateConnection();
}
}
}
The certificate is a .pem certificate I have put on the client. I'm using port 8071. The certificate path is of format "D:\RabbitMQ_DF_SIT_Server_certificate\ca_certificate.pem". I'm using the RabbitMQ client from NuGet 5.1.0
I doubt I need Certificate Validation Callback Method because from what I understand its one way connection. This application will only consume & not publish at all. What am I missing? The certificate is sitting on the client server but not installed per se.
It throws an error :
RabbitMQ.Client.Exceptions.BrokerUnreachableException: None of the specified endpoints were reachable ---> System.AggregateException: One or more errors occurred. ---> System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: The client and server cannot communicate, because they do not possess a common algorithm

Answer 1

In order to use TLS with RabbitMQ one has to enable this via the RabbitMQ config located in Windows at %APPDATA%/RabbitMQ/rabbitmq.conf file.
Depending on the Erlang version being used, the config can be the classic format / ini style. For more details, please refer to https://www.rabbitmq.com/configure.html
With the newer ini style configuration format, the config should look like this
listeners.ssl.default = 5671
ssl_options.verify = verify_none
ssl_options.fail_if_no_peer_cert = false
ssl_options.cacertfile = <location to cacertfile.crt>
ssl_options.certfile = <location to certfile.crt>
ssl_options.keyfile = <location to private.key>
All of the above can be automated and verified via a script that I wrote for this
https://gist.github.com/skewl84/a72321379a65c4c5cfd447f8806b5188
The script above does
Check if OpenSSL is installed else download to generate Self-Signed certificate if neccessary
Modify RabbbitMQ config to enable TLS
Use OpenSSL to Test TLS after it has been enabled on the RabbitMQ