I've been trying to find available options for configuring CRL checking within RabbitMQ. RabbitMQ in turn seems to rely on Erlang's SSL library. Unfortunately, knowing very little about Erlang, so it has been difficult for me to understand:

  • The exact syntax of an HTTP timeout-based CRL approach (and if this is automagically pulled from the cert's CRL info)
  • If a local-file based CRL approach is available out of the box

Examples of the crl_cache configuration option have been hard to find. Does anyone have further information on this?

1 Answer 1


Starting with the configuration example from the RabbitMQ TLS support page, add the crl_check and crl_cache options like this:

  {rabbit, [
     {ssl_listeners, [5671]},
     {ssl_options, [{cacertfile,"/path/to/testca/cacert.pem"},
                    {crl_check, true},
                    {crl_cache, {ssl_crl_cache, {internal, [{http, 5000}]}}}

Setting crl_check to true means that CRLs will be checked for the entire certificate chain, and if any CRL is missing validation will fail. You could set it to peer or best_effort instead; see the Erlang ssl module documentation for details.

In the sample above, I activated downloading of CRLs by HTTP, with a timeout of 5 seconds (5000 milliseconds). The URL is taken from the cRLDistributionPoints extension in the certificate.

There is currently no local-file based CRL approach available out of the box, but I have submitted a pull request that lets you get CRLs from a local directory the same way Apache does it.

  • Hey, this is invaluable information - thanks for answering! If you have connections to the RabbitMQ developers, would you please drop them a line to add this example to their certificate documentation? Again, thanks so much!
    – J Trana
    Apr 12, 2016 at 13:53
  • Additionally, do you know of any further resources around additional logging for this feature? I have gotten to the point where the CRL is being retrieved from the server but then even with a OpenSSL validated CRL file Rabbit is rejecting what I believe to be valid requests. Thanks for your help so far!
    – J Trana
    May 4, 2016 at 21:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.