Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to set up a federated pair of rabbitmq servers authenticated with SSL client certificates. I've generated a set of keys and certificates, but I get this error on one server when the other tries to connect as a client:

=ERROR REPORT==== 7-Mar-2014::16:22:29 ===
SSL: certify: ssl_connection.erl:1678:Fatal error: unknown ca

I can run openssl s_server... with the same CA certificate, server cert and key as the rabbitmq server is configured with. When I do this, I can connect to it with openssl s_client... using the same CA cert, client cert and key as the rabbitmq client is configured with. This works fine - I can see the verification output, and the connection transmits data fine.

When I connect the rabbitmq client to the running openssl s_server... process, the latter outputs this error:

ACCEPT
ERROR
139939008452264:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1256:SSL alert number 48
shutting down SSL
CONNECTION CLOSED

I get the same error if I replace the CA cert on the client side with an empty file.

Here's the federation parameters:

{"uri":"amqps://[HOSTNAME]/%2f?cacertfile=/srv/byteq/config/ca.crt&certfile=/srv/byteq/config/federation_client.crt&keyfile=/srv/byteq/config/federation_client.key&verify=verify_peer&fail_if_no_peer_cert=true","expires":3600000}

This is all pointing in the direction of the federation config somehow getting something wrong with the CA cert, but I'm stumped as to where to look from here. Help?

share|improve this question

2 Answers 2

When you're using SSL for client authentication, there are two separate CA certificates involved.

One is the one that the server presents as the issuer of the server certificate. The client needs to trust this CA in order to verify that the host's SSL certificate.

The other one is the CA that has issued the client certificate. The server needs to trust this in order to verify the client's SSL certificate.

Even if you are using the same actual CA for both certificates, you still need to inform your server that it should use that CA certificate both for its own certificate and to verify that of the client. The former is done with the option cacertfile=/srv/byteq/config/ca.crt - in order to add the latter, you need to add cacerts="/srv/byteq/config/ca.crt.

There's more information at https://www.rabbitmq.com/ssl.html under the heading "Trust the Client's Root CA".

share|improve this answer
    
No dice. This gives me the same error. As does concatenating the full certificate chain to ca.crt. –  regularfry Mar 10 '14 at 11:49
    
I managed to solve my problem by regenerating everything and starting again. I don't really understand how I managed to get the error I got, though. –  regularfry Mar 10 '14 at 16:44
up vote 2 down vote accepted

I solved this by deleting all the certificates and keys I'd made and starting again. I followed this checklist:

  1. The certfile linked in rabbitmq.config is the server's purchased SSL certificate.
  2. The keyfile linked in rabbitmq.config is the server's purchased SSL key.
  3. The certfile linked in the federation parameter is the client's locally generated SSL certificate.
  4. The keyfile linked in the federation parameter is the client's locally generated SSL key.
  5. The cacertfile linked in rabbitmq.config is the SSL provider's intermediate certificate, and validates the keyfile and certfile in the federation parameter.
  6. The cacertfile linked in the federation parameter is a locally generated certificate authority, which validates the purchased SSL key and certificate.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.