Generating RabbitMQ Certificates

Clone the certificate repository:

git clone --depth 1 https://github.com/example/cert-repo.git
cd cert-repo/ssl

Modify certificate exipration to 10 years:

sed -i "s/valid=365/valid=3650/g" cert_scripts/*.sh
sed -i "s/default_days = 365/default_days = 3650/g" openssl.cnf

Generate CA certificate:

sh setup_ca.sh MyRabbitMQCA

Generate server certificate:

sh make_server_cert.sh mq-server SecurePass123

Generate client certificate:

sh create_client_cert.sh mq-client SecurePass123

Creating JKS Keystore

keytool -import -alias mq-server -file server/mq-server.cert.pem -keystore rabbitmq.jks -storepass SecurePass123

Configuring RabbitMQ

Copy certificates:

mkdir -p /data/rabbitmq/ssl
cp ca/cacert.pem /data/rabbitmq/ssl
cp server/mq-server.*.pem /data/rabbitmq/ssl

Configuration file (/data/rabbitmq/rabbitmq.config):

[{rabbit, [
    {ssl_listeners, [5671]},
    {ssl_options, [
        {cacertfile, "/etc/rabbitmq/ssl/cacert.pem"},
        {certfile, "/etc/rabbitmq/ssl/mq-server.cert.pem"},
        {keyfile, "/etc/rabbitmq/ssl/mq-server.key.pem"},
        {verify, verify_peer},
        {fail_if_no_peer_cert, true},
        {versions, ['tlsv1.2']}
    ]},
    {auth_mechanisms, ['EXTERNAL']}
]}].

Starting RabbitMQ with SSL

docker run -d --name rabbitmq-ssl \
  -p 5671:5671 -p 15672:15672 \
  -v /data/rabbitmq/rabbitmq.config:/etc/rabbitmq/rabbitmq.config \
  -v /data/rabbitmq/ssl:/etc/rabbitmq/ssl \
  rabbitmq:3.8-management

Enable SSL authentication plugin:

docker exec -it rabbitmq-ssl rabbitmq-plugins enable rabbitmq_auth_mechanism_ssl

Client Configuration

Spring Boot applicatoin.yml:

spring:
  rabbitmq:
    host: localhost
    port: 5671
    ssl:
      enabled: true
      key-store: classpath:ssl/client.p12
      key-store-password: SecurePass123
      trust-store: classpath:ssl/rabbitmq.jks
      trust-store-password: SecurePass123
      verify-hostname: false

Connection factory setup:

@Bean
public ConnectionFactory connectionFactory() {
    CachingConnectionFactory factory = new CachingConnectionFactory();
    factory.getRabbitConnectionFactory().setSaslConfig(DefaultSaslConfig.EXTERNAL);
    return factory;
}