4

I'm trying to set up a federated pair of rabbitmq servers authenticated with SSL client certificates. I've generated a set of keys and certificates, but I get this error on one server when the other tries to connect as a client:

=ERROR REPORT==== 7-Mar-2014::16:22:29 ===
SSL: certify: ssl_connection.erl:1678:Fatal error: unknown ca

I can run openssl s_server... with the same CA certificate, server cert and key as the rabbitmq server is configured with. When I do this, I can connect to it with openssl s_client... using the same CA cert, client cert and key as the rabbitmq client is configured with. This works fine - I can see the verification output, and the connection transmits data fine.

When I connect the rabbitmq client to the running openssl s_server... process, the latter outputs this error:

ACCEPT
ERROR
139939008452264:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1256:SSL alert number 48
shutting down SSL
CONNECTION CLOSED

I get the same error if I replace the CA cert on the client side with an empty file.

Here's the federation parameters:

{"uri":"amqps://[HOSTNAME]/%2f?cacertfile=/srv/byteq/config/ca.crt&certfile=/srv/byteq/config/federation_client.crt&keyfile=/srv/byteq/config/federation_client.key&verify=verify_peer&fail_if_no_peer_cert=true","expires":3600000}

This is all pointing in the direction of the federation config somehow getting something wrong with the CA cert, but I'm stumped as to where to look from here. Help?

2 Answers 2

2
+50

When you're using SSL for client authentication, there are two separate CA certificates involved.

One is the one that the server presents as the issuer of the server certificate. The client needs to trust this CA in order to verify that the host's SSL certificate.

The other one is the CA that has issued the client certificate. The server needs to trust this in order to verify the client's SSL certificate.

Even if you are using the same actual CA for both certificates, you still need to inform your server that it should use that CA certificate both for its own certificate and to verify that of the client. The former is done with the option cacertfile=/srv/byteq/config/ca.crt - in order to add the latter, you need to add cacerts="/srv/byteq/config/ca.crt.

There's more information at https://www.rabbitmq.com/ssl.html under the heading "Trust the Client's Root CA".

2
  • No dice. This gives me the same error. As does concatenating the full certificate chain to ca.crt.
    – regularfry
    Mar 10, 2014 at 11:49
  • I managed to solve my problem by regenerating everything and starting again. I don't really understand how I managed to get the error I got, though.
    – regularfry
    Mar 10, 2014 at 16:44
2

I solved this by deleting all the certificates and keys I'd made and starting again. I followed this checklist:

  1. The certfile linked in rabbitmq.config is the server's purchased SSL certificate.
  2. The keyfile linked in rabbitmq.config is the server's purchased SSL key.
  3. The certfile linked in the federation parameter is the client's locally generated SSL certificate.
  4. The keyfile linked in the federation parameter is the client's locally generated SSL key.
  5. The cacertfile linked in rabbitmq.config is the SSL provider's intermediate certificate, and validates the keyfile and certfile in the federation parameter.
  6. The cacertfile linked in the federation parameter is a locally generated certificate authority, which validates the purchased SSL key and certificate.
1
  • same problem here, curious to know if you used any tools for the certs? letsencrypt, tls-gen, or just plain openssl? thanks!
    – martin
    Dec 10, 2020 at 6:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .