<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">Hi All,<br><br>I tried to setup SSL onmy development machine by following the instructions provided in <a href="https://www.rabbitmq.com/ssl.html">https://www.rabbitmq.com/ssl.html</a>. And then created rabbitmq.cong file with the below settings. </div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style><div class="gmail_default" style><font color="#666666" face="courier new, monospace">[</font></div><div class="gmail_default" style>
<font color="#666666" face="courier new, monospace"> {rabbit, [</font></div><div class="gmail_default" style><font color="#666666" face="courier new, monospace"> {ssl_listeners, [5671]},</font></div><div class="gmail_default" style>
<font color="#666666" face="courier new, monospace"> {ssl_options, [{cacertfile,"/opt/ssl/testca/cacert.pem"},</font></div><div class="gmail_default" style><font color="#666666" face="courier new, monospace"> {certfile,"/opt/ssl/server/cert.pem"},</font></div>
<div class="gmail_default" style><font color="#666666" face="courier new, monospace"> {keyfile,"/opt/ssl/server/key.pem"},</font></div><div class="gmail_default" style><font color="#666666" face="courier new, monospace"> {verify,verify_peer},</font></div>
<div class="gmail_default" style><font color="#666666" face="courier new, monospace"> {fail_if_no_peer_cert,true}]},</font></div><div class="gmail_default" style><font color="#666666" face="courier new, monospace"> {auth_mechanisms, ['EXTERNAL']},</font></div>
<div class="gmail_default" style><font color="#666666" face="courier new, monospace"> {ssl_cert_login_from, common_name}</font></div><div class="gmail_default" style><font color="#666666" face="courier new, monospace"> ]}</font></div>
<div class="gmail_default" style><font color="#666666" face="courier new, monospace">].</font></div><div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif">After restarting the rabbitmq server I tried to connect to RabbitMq via AMQP Gem with the below code, but I am getting authentication failure error.</div>
<div style="font-family:tahoma,sans-serif"><br></div><div style="font-family:tahoma,sans-serif"><b><u>RUBY CODE:</u></b></div><div style="font-family:tahoma,sans-serif"><b><br></b></div><div><font face="courier new, monospace" color="#666666">RMQ_CONFIGURATIONS = {:host=>"127.0.0.1", :port=>5671, :vhost=>"/", :auth_mechanism=>"EXTERNAL", :ssl=>{:cert_chain_file=>"/opt/ssl/client/cert.pem", :private_key_file=>"/opt/ssl/client/key.pem"}} <br>
</font></div><div style><font face="courier new, monospace" color="#666666"><br></font></div><div style><div><font face="courier new, monospace" color="#666666">AMQP.start(RMQ_CONFIGURATIONS) do |connection|</font></div>
<div>
<font face="courier new, monospace" color="#666666">puts "Connected, authenticated. TLS seems to work."</font></div><div><font face="courier new, monospace" color="#666666"><br></font></div><div><font face="courier new, monospace" color="#666666">connection.disconnect { puts "Now closing the connection..."; EventMachine.stop }</font></div>
<div><font face="courier new, monospace" color="#666666">end</font></div><div><font face="courier new, monospace" color="#666666"><br></font></div><div><font face="courier new, monospace" color="#666666"><br></font></div>
<div><font face="courier new, monospace"><div><font color="#e06666">AMQP::PossibleAuthenticationFailureError: AMQP broker closed TCP connection before authentication succeeded: this usually means authentication failure due to misconfiguration. Settings are {:host=>"127.0.0.1", :port=>5671, :user=>"guest", :pass=>"[filtered]", :auth_mechanism=>"EXTERNAL", :vhost=>"/", :timeout=>nil, :logging=>false, :ssl=>{:cert_chain_file=>"/opt/ssl/client/cert.pem", :private_key_file=>"/opt/ssl/client/key.pem"}, :frame_max=>131072, :heartbeat=>0}</font></div>
<div style="color:rgb(102,102,102)"><br></div></font></div></div><div style><font face="tahoma, sans-serif"><br></font></div><div style><font face="tahoma, sans-serif"><b><u>RABBITMQ LOG:</u></b></font></div><div style><font face="tahoma, sans-serif"><b><br>
</b></font></div><div style><font face="tahoma, sans-serif"><div style="font-weight:bold"><br></div><div><font color="#666666">==> /var/log/rabbitmq/rabbit@ubuntu.log <==</font></div><div><font color="#666666"><br>
</font></div>
<div><font color="#666666">=INFO REPORT==== 29-Apr-2014::13:26:19 ===</font></div><div><font color="#666666">accepting AMQP connection <0.862.0> (<a href="http://127.0.0.1:40657">127.0.0.1:40657</a> -> <a href="http://127.0.0.1:5671">127.0.0.1:5671</a>)</font></div>
<div><font color="#666666"><br></font></div><div><font color="#666666">=ERROR REPORT==== 29-Apr-2014::13:26:22 ===</font></div><div><font color="#666666">closing AMQP connection <0.862.0> (<a href="http://127.0.0.1:40657">127.0.0.1:40657</a> -> <a href="http://127.0.0.1:5671">127.0.0.1:5671</a>):</font></div>
<div><font color="#666666">{handshake_error,starting,0,</font></div><div><font color="#666666"> {amqp_error,access_refused,</font></div><div><font color="#666666"> </font><b><font color="#e06666"> "EXTERNAL login refused: user 'ubuntu' - invalid credentials",</font></b></div>
<div><font color="#666666"> 'connection.start_ok'}}</font></div><div><font color="#666666"><br></font></div><div><font color="#666666"><br></font></div><div><font color="#000000">I validated the SSL certificates using the below command and I got the VERIFY OK as response.</font></div>
<div><br></div><div><b style="color:rgb(0,0,0)"><u>SSL VALIDATION I/P</u></b><br></div><div><b style="color:rgb(0,0,0)"><u><br></u></b></div><div><div><font color="#666666">openssl s_server -accept 443 -cert /opt/ssl/server/cert.pem -key /opt/ssl/server/key.pem -CAfile /opt/ssl/testca/cacert.pem</font></div>
<div><font color="#666666"><br></font></div><div><font color="#666666">openssl s_client -connect localhost:443 -cert /opt/ssl/client/cert.pem -key /opt/ssl/client/key.pem -CAfile testca/cacert.pem</font></div><div style="color:rgb(0,0,0)">
<br></div><div style="color:rgb(0,0,0)"><b><u>SSL VALIDATION O/P</u></b></div><div style="color:rgb(0,0,0)"><b><u><br></u></b></div><div><div><font color="#666666">CONNECTED(00000003)</font></div><div><font color="#666666">depth=1 CN = MyTestCA</font></div>
<div><font color="#666666">verify return:1</font></div><div><font color="#666666">depth=0 CN = ubuntu, O = server</font></div><div><font color="#666666">verify return:1</font></div><div><font color="#666666">---</font></div>
<div><font color="#666666">Certificate chain</font></div><div><font color="#666666"> 0 s:/CN=ubuntu/O=server</font></div><div><font color="#666666"> i:/CN=MyTestCA</font></div><div><font color="#666666"> 1 s:/CN=MyTestCA</font></div>
<div><font color="#666666"> i:/CN=MyTestCA</font></div><div><font color="#666666">---</font></div><div><font color="#666666">Server certificate</font></div><div><font color="#666666">-----BEGIN CERTIFICATE-----</font></div>
<div><font color="#666666">MIIC3zCCAcegAwIBAgIBATANBgkqhkiG9w0BAQUFADATMREwDwYDVQQDEwhNeVRl</font></div><div><font color="#666666">c3RDQTAeFw0xNDA0MjkwNzIzMTFaFw0xNTA0MjkwNzIzMTFaMCIxDzANBgNVBAMM</font></div><div><font color="#666666">BnVidW50dTEPMA0GA1UECgwGc2VydmVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A</font></div>
<div><font color="#666666">MIIBCgKCAQEAw7066GHqFC4xtEwi4tRTDscHCsuSXFne6wpPl3kQ/Cf+91YVosgC</font></div><div><font color="#666666">fNmsxj4MQQxiPFqr/l6Dhscsdd6OL3PuSfetu+MSS+lD+UmF5QZ5D3ezN9I35sVw</font></div><div><font color="#666666">NigQ9CCfsBxfGfQDc6llJpt/3V3p/ropijGO2FaIBGp/Xn42FQJSbe8wCwMlulBV</font></div>
<div><font color="#666666">9rSPbFfo71OjXhHH9PcG+RL29omNDY6a2c0vCr9LOJZH8qpCPTFjO0ueFUqIpi31</font></div><div><font color="#666666">uaZ/DojNHb/KfZOfaWXRn/oLknfbNdDnxyt+VwNGTJ7NlMo6PuhiB6H60kzZ+44V</font></div><div><font color="#666666">c8jtR+skt2MMo0WKWCeaqFzM/kWtmU2AzwIDAQABoy8wLTAJBgNVHRMEAjAAMAsG</font></div>
<div><font color="#666666">A1UdDwQEAwIFIDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQUFAAOC</font></div><div><font color="#666666">AQEAm1khz04OM/rssO4biVbMKv5g2d7skRByN1TuPVpnc34vVBTVErEBeL19S4VA</font></div><div><font color="#666666">PwhJm0+E+fVgdPPR/m3Yjh5LvXYpq4pkdFjvHmbdzj5CTiRRJ/SUdCGVKOFuFnU8</font></div>
<div><font color="#666666">ecJtfjz9qK8BKvqlIb0J1FYmUalFaTvpqNYa96y1SmF4MFbcVgu0ZjqKXcHpU0vH</font></div><div><font color="#666666">5rsX0VqbqbyQv3oI05BmuR0Ta0AGxMc/VDGRI25oCpcEjICa7shYZDVa8uISZMlc</font></div><div><font color="#666666">pnPLUxNBKjD7INqwx9y3Ikl70zou3xA6akZHnTFhcn0ak0WSob+O/L8rlNM4ANM/</font></div>
<div><font color="#666666">n3fWiKRnyZ9zRPmx7cB6MsUx0w==</font></div><div><font color="#666666">-----END CERTIFICATE-----</font></div><div><font color="#666666">subject=/CN=ubuntu/O=server</font></div><div><font color="#666666">issuer=/CN=MyTestCA</font></div>
<div><font color="#666666">---</font></div><div><font color="#666666">No client certificate CA names sent</font></div><div><font color="#666666">---</font></div><div><font color="#666666">SSL handshake has read 2137 bytes and written 375 bytes</font></div>
<div><font color="#666666">---</font></div><div><font color="#666666">New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA</font></div><div><font color="#666666">Server public key is 2048 bit</font></div><div><font color="#666666">Secure Renegotiation IS supported</font></div>
<div><font color="#666666">Compression: NONE</font></div><div><font color="#666666">Expansion: NONE</font></div><div><font color="#666666">SSL-Session:</font></div><div><font color="#666666"> Protocol : TLSv1.1</font></div>
<div><font color="#666666"> Cipher : ECDHE-RSA-AES256-SHA</font></div><div><font color="#666666"> Session-ID: A74004CB078A50AFE2CDA0550BE606DB7747BBF9386ED348129CEDCADDB8B753</font></div><div><font color="#666666"> Session-ID-ctx: </font></div>
<div><font color="#666666"> Master-Key: 366B450D2C99556844C47A27B280AAA1F7BA1CC5196B1BB9FC4E5FABC95493C873DBF9375116E3E3036DAC51D406741C</font></div><div><font color="#666666"> Key-Arg : None</font></div><div><font color="#666666"> PSK identity: None</font></div>
<div><font color="#666666"> PSK identity hint: None</font></div><div><font color="#666666"> SRP username: None</font></div><div><font color="#666666"> TLS session ticket lifetime hint: 300 (seconds)</font></div>
<div>
<font color="#666666"> TLS session ticket:</font></div><div><font color="#666666"> 0000 - 4f 5f 65 19 7c 30 46 78-34 58 21 af 6b aa 4e 39 O_e.|0Fx4X!.k.N9</font></div><div><font color="#666666"> 0010 - 58 4a a4 70 0d bb 00 fe-e4 8c 5e dd 9f 66 6d 33 XJ.p......^..fm3</font></div>
<div><font color="#666666"> 0020 - bf 0a e6 37 a2 8c 07 a4-88 43 de c3 b0 77 2c 9d ...7.....C...w,.</font></div><div><font color="#666666"> 0030 - f1 f4 8a 1b de d5 10 fd-7b 0f bc 91 91 3b ed ba ........{....;..</font></div>
<div><font color="#666666"> 0040 - fe bc 9a 35 75 a0 b9 b2-f3 a1 12 da 4c 7a 81 fb ...5u.......Lz..</font></div><div><font color="#666666"> 0050 - 42 c7 68 7c e8 38 16 d2-dc a9 c3 d6 6e 7a 5d 7d B.h|.8......nz]}</font></div>
<div><font color="#666666"> 0060 - f6 51 7c ed 9f 0d fe 7d-f1 d2 65 03 3d 56 75 23 .Q|....}..e.=Vu#</font></div><div><font color="#666666"> 0070 - 8c 70 de fb 40 a1 f8 9a-fa 28 85 7a 97 1f e0 5d .p..@....(.z...]</font></div>
<div><font color="#666666"> 0080 - 9b d2 2c e4 67 91 e6 51-d0 05 c9 cc 8f 8e 38 a3 ..,.g..Q......8.</font></div><div><font color="#666666"> 0090 - 9c b7 4d b1 8f 98 c8 1f-a6 59 26 fd fe e1 94 1b ..M......Y&.....</font></div>
<div><font color="#666666"><br></font></div><div><font color="#666666"> Start Time: 1398758603</font></div><div><font color="#666666"> Timeout : 300 (sec)</font></div><div><font color="#666666"> </font><font color="#38761d"> Verify return code: 0 (ok)</font></div>
<div><font color="#666666">---</font></div></div><div style="color:rgb(0,0,0)"><br></div></div></font></div><div style="font-family:tahoma,sans-serif"><br></div></div><div><font style="font-family:tahoma,sans-serif" face="tahoma, sans-serif">regards,<br>
Loganathan<br>Mob: +91 7760780741 | +91 9944414388<br>Skype: loganathan.sellappa<br></font><span style="font-family:tahoma,sans-serif"><a href="http://vizualize.me/loganathan" target="_blank">ViewMe</a></span><br><br></div>
</div>