RabbitMQ plain authentication with SSL/TLS - ssl

Question

I am trying to find example code on how to get this to work. Without having to specify any certificates on the client side. Does anyone have an example of how to do this?
All examples I have found online use SSL/TLS for authentication as well as transport security.

Answer 1

Yes.
You need to add an auth_mechanisms = PLAIN or AMQPPLAIN in rabbitmq.conf
Configure certificates in the server and client.
It isn't needed to use rabbitmq_auth_mechanism_ssl plugin
Using Java you need to create a KeyStore, KeyManagerFactory and TrustManagerFactory, and send your certificate.
Using Python you'll need to use ssl package and create a context and load a certificate chain and send to the server your certificate.
After configuring ssl as in the documentation, using Java create a factory, and set a user and a password. Using Python create a PlainCredentials.
In Python will be something like this:
import pika
import sys
import ssl
context = ssl.create_default_context(cafile="/home/userx/rabbitmq/certs/testca/ca.crt")
context.load_cert_chain("/home/userx/rabbitmq/certs/client/client_certificate.pem", "/home/userx/rabbitmq/certs/client/private_key.pem")
ssl_options = pika.SSLOptions(context, server_hostname="xrabbit")
context.verify_mode = ssl.CERT_REQUIRED
context.load_verify_locations('/home/userx/rabbitmq/certs/testca/ca.crt')
credentials = pika.PlainCredentials('user1', 'password%!xyz$328')
parameters = pika.ConnectionParameters('xrabbit',5671,'/',credentials, ssl_options=ssl_options)
connection = pika.BlockingConnection(parameters)
channel = connection.channel()
In Java something like this:
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(new FileInputStream("/home/userx/rabbitmq/certs/client_keystore.pkcs12"), keyPassphrase);
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
kmf.init(ks, keyPassphrase);
char[] trustPassphrase = "rabbit".toCharArray();
KeyStore tks = KeyStore.getInstance("PKCS12");
tks.load(new FileInputStream("/home/userx/rabbitmq/certs/trust_store"), trustPassphrase);
TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");tmf.init(tks);
SSLContext c = SSLContext.getInstance("TLSv1.3");
c.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
ConnectionFactory factory = new ConnectionFactory();
factory.setHost("xrabbit");
factory.setPort(5671);
factory.setUsername("user1");
factory.setPassword("password$321xk!!44");
factory.setSaslConfig(DefaultSaslConfig.PLAIN);
factory.useSslProtocol(c);
factory.enableHostnameVerification();
Connection conn = factory.newConnection();
Channel channel = conn.createChannel();
Finally, use Wireshark to check the connection, only TLS packets should appear, if your client connection is using only plain text, will appear TLS packets from the server, but your client will send AMQP packets, if your server and client are using TLS you'll see only TLS packets.

Answer 2

Follow the official website documentation:
https://www.rabbitmq.com/ssl.html
You can find the configuration with and without client side configuration.