Implementing TLS/SSL Security

# Generate CA private key
openssl genrsa -out ca.key 2048

# Generate CA certificate
openssl req -new -x509 -key ca.key -out ca.crt -days 365 -subj "/C=US/ST=State/L=City/O=Organization/CN=RabbitMQ-CA"

# Generate server private key
openssl genrsa -out server.key 2048

# Generate server certificate signing request (CSR)
openssl req -new -key server.key -out server.csr -subj "/C=US/ST=State/L=City/O=Organization/CN=localhost"

# Sign server certificate with CA
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365

# Enable TLS listener on port 5671
listeners.ssl.default = 5671

# Specify paths to certificate and key files
ssl_options.certfile = /etc/rabbitmq/server_certificate.pem
ssl_options.keyfile = /etc/rabbitmq/server_private_key.pem
ssl_options.cacertfile = /etc/rabbitmq/ca_certificate.pem

# Require client certificates
ssl_options.verify = verify_peer
ssl_options.fail_if_no_peer_cert = true

{ssl, [
  {certfile, "/etc/rabbitmq/ssl/server_cert.pem"},
  {keyfile, "/etc/rabbitmq/ssl/server_key.pem"},
  {cacertfile, "/etc/rabbitmq/ssl/cacert.pem"},
  {verify, verify_peer},
  {fail_if_no_peer_cert, true}
]},
{tcp_listeners, [
  {5671, [{ssl, true}]}
]}

{
  "listeners": {
    "ssl": {
      "port": 5671,
      "ssl_options": {
        "certfile": "/path/to/server_cert.pem",
        "keyfile": "/path/to/server_key.pem",
        "cafile": "/path/to/ca_cert.pem",
        "verify": true,
        "fail_if_no_peer_cert": true
      }
    }
  },
  "auth_mechanisms": ["external"]
}

listeners.ssl.default = 5671
ssl_options.version = tlsv1.2
ssl_options.ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256
ssl_options.honor_cipher_order = true

listeners.ssl.default = 5671
ssl_options.ciphers = [
  "ECDHE-RSA-AES256-GCM-SHA384",
  "ECDHE-ECDSA-AES256-GCM-SHA384",
  "ECDHE-RSA-AES128-GCM-SHA256",
  "ECDHE-ECDSA-AES128-GCM-SHA256"
]
ssl_options.minimum_version = "tlsv1.2"

{
  "ssl_options": {
    "sni": true,
    "sni_host": "broker.example.com"
  }
}

listeners.ssl.default = 5671
ssl_options.cacertfile = "/path/to/ca_certificate.pem"
ssl_options.certfile = "/path/to/server_certificate.pem"
ssl_options.keyfile = "/path/to/server_key.pem"
ssl_options.ocsp.stapling = true
ssl_options.ocsp.cache_timeout = 300
ssl_options.ocsp.fallback = allow

{
  "ssl_options": {
    "cacertfile": "/etc/rabbitmq/certs/new-ca-cert.pem",
    "certfile": "/etc/rabbitmq/certs/new-server-cert.pem",
    "keyfile": "/etc/rabbitmq/certs/new-server-key.pem",
    "handshake_timeout": 10000
  }
}

openssl s_client -connect rabbitmq.example.com:5671 -starttls amqp

openssl s_client -connect rabbitmq.example.com:5671 -starttls amqp << EOF
<pre>
GET /api/health HTTP/1.1
Host: rabbitmq.example.com
</pre>
EOF

management:
  ssl:
    enabled: true
    key: "path/to/key.pem"
    certfile: "path/to/cert.pem"
    cafile: "path/to/ca.pem"
  metrics:
    enabled: true

SSL: CERTIFICATE_VERIFY_FAILED
SSL: CERTIFICATE_UNKNOWN
SSL: HANDSHAKE_FAILURE