<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi,<div><br></div><div>I�m running RabbitMQ with the MQTT adaptor enabled along with SSL. I�ve discovered that if a small number of connections fail the SSL handshake (e.g. the client rejecting the server�s certificate because it doesn�t recognize the certificate authority) it prevents other SSL connections being established to the server for a short period of time. If a �bad client� (i.e. one that fails the SSL handshake) keeps trying to reconnect then it effectively locks up the server.</div><div><br></div><div>A simple way I found to demonstrate this is by creating my own certificate authority, certificates, keys etc for RabbitMQ as per the instructions at <a href="https://www.rabbitmq.com/ssl.html">https://www.rabbitmq.com/ssl.html</a> and adding the relevant ssl options to the RabbitMQ config file but put the ssl_listeners element into the rabbitmq_mqtt tuple. Then, implement a basic MQTT client in Java using the Paho client libraries. When the client is ran, an exception is thrown as expected since the certificate isn�t trusted. If this client is put into a basic load test, where a new client is created and attempts to connect to the server every 2 seconds, it will prevent other clients connecting. This can be observed by simply using the "openssl s_client� command, which will just hang during the time the Java clients are trying to connect.</div><div><br></div><div>A sample from the RabbitMQ log file when this occurs is:</div><div><br></div><div><div><div>=ERROR REPORT==== 10-Apr-2014::21:49:33 ===</div><div>SSL: certify: ssl_connection.erl:1724:Fatal error: certificate unknown</div><div><br></div><div>=ERROR REPORT==== 10-Apr-2014::21:49:38 ===</div><div>** Generic server <0.689.0> terminating</div><div>** Last message in was {inet_async,#Port<0.15200>,48667,{ok,#Port<0.16417>}}</div><div>** When Server state == {state,</div><div> {rabbit_mqtt_sup,start_ssl_client,</div><div> [[{cacertfile,"/home/sking/ssl/cacert.pem"},</div><div> {certfile,"/home/sking/ssl/cert.pem"},</div><div> {keyfile,"/home/sking/ssl/key.pem"},</div><div> {verify,verify_none},</div><div> {fail_if_no_peer_cert,false}]]},</div><div> #Port<0.15200>,48667}</div><div>** Reason for termination ==</div><div>** {timeout,{gen_server2,call,</div><div> [<0.718.0>,</div><div> {go,#Port<0.16417>,</div><div> #Fun<rabbit_networking.1.24135120>}]}}</div><div><br></div><div>=ERROR REPORT==== 10-Apr-2014::21:49:38 ===</div><div>** Generic server <0.718.0> terminating</div><div>** Last message in was {go,#Port<0.16417>,#Fun<rabbit_networking.1.24135120>}</div><div>** When Server state == undefined</div><div>** Reason for termination ==</div><div>** {{badmatch,{error,{ssl_upgrade_error,"certificate unknown"}}},</div><div> [{rabbit_mqtt_reader,handle_call,3,[]},</div><div> {gen_server2,handle_msg,2,[]},</div><div> {proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,227}]}]}</div></div></div><div><br></div><div><br></div><div>That particular example is on a server running RabbitMQ 3.1.0 / Erlang R15B03, however I have also reproduced it on the more recent RabbitMQ 3.3.0 / Erlang R16B03-1.</div><div><br></div><div>I also ran a similar test using AMQP and could not reproduce, so this issue only seems to be with using MQTT over SSL.</div><div><br></div><div>Regards,</div><div><br></div><div>Stuart</div><div><br></div><div><br></div><div><br></div></body></html>