I'm trying to set up a federated pair of rabbitmq servers authenticated with SSL client certificates. I've generated a set of keys and certificates, but I get this error on one server when the other tries to connect as a client:
=ERROR REPORT==== 7-Mar-2014::16:22:29 ===
SSL: certify: ssl_connection.erl:1678:Fatal error: unknown ca
I can run openssl s_server...
with the same CA certificate, server cert and key as the rabbitmq server is configured with. When I do this, I can connect to it with openssl s_client...
using the same CA cert, client cert and key as the rabbitmq client is configured with. This works fine - I can see the verification output, and the connection transmits data fine.
When I connect the rabbitmq client to the running openssl s_server...
process, the latter outputs this error:
ACCEPT
ERROR
139939008452264:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1256:SSL alert number 48
shutting down SSL
CONNECTION CLOSED
I get the same error if I replace the CA cert on the client side with an empty file.
Here's the federation parameters:
{"uri":"amqps://[HOSTNAME]/%2f?cacertfile=/srv/byteq/config/ca.crt&certfile=/srv/byteq/config/federation_client.crt&keyfile=/srv/byteq/config/federation_client.key&verify=verify_peer&fail_if_no_peer_cert=true","expires":3600000}
This is all pointing in the direction of the federation config somehow getting something wrong with the CA cert, but I'm stumped as to where to look from here. Help?