how to enable SSL/TLS in rabbitmq for rabbitmq:3-management docker image. #470

devopsenggineer · 2021-02-28T08:27:51Z

devopsenggineer
Feb 28, 2021

how to enable SSL/TLS in rabbitmq for rabbitmq:3-management docker image.

I have followed the docker hub link(https://hub.docker.com/_/rabbitmq) of rabbitmq to deploy a rabbitmq docker container with below command to test and enable ssl/tls in rabbitmq

docker run

docker run -d --hostname my-rabbit --name some-rabbit -p 5671:5671 -p 5672:5672 -p 15671:15671  -e RABBITMQ_NODENAME=rabbitnode -e RABBITMQ_DEFAULT_TCP=false -e RABBITMQ_DEFAULT_USER=admin  -e RABBITMQ_DEFAULT_PASS=admin  -e RABBITMQ_ERLANG_COOKIE=6a8ef42097f82602b9d9bc4c27dbe8bd -e RABBITMQ_DEFAULT_VHOST=test -e RABBITMQ_VM_MEMORY_HIGH_WATERMARK=1500MiB -e RABBITMQ_SSL_CERT_FILE=/certs/server_certificate.pem -e RABBITMQ_SSL_KEY_FILE=/certs/server_key.pem -e RABBITMQ_SSL_CA_FILE=/certs/ca_certificate.pem -e RABBITMQ_SSL_FAIL_IF_NO_PEER_CERT=false -e RABBITMQ_SSL_VERIFY=verify_peer -v /home/ubuntu/rabbitmq-tls/:/certs/ rabbitmq:3-management

# Below are the logs of rabbit container
docker logs some-rabbit


2021-02-28 07:01:12.758 [info] <0.44.0> Application lager started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:12.983 [info] <0.44.0> Application mnesia started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:12.983 [info] <0.293.0> 
 Starting RabbitMQ 3.8.12 on Erlang 23.2.6
 Copyright (c) 2007-2021 VMware, Inc. or its affiliates.
 Licensed under the MPL 2.0. Website: https://rabbitmq.com

  ##  ##      RabbitMQ 3.8.12
  ##  ##
  ##########  Copyright (c) 2007-2021 VMware, Inc. or its affiliates.
  ######  ##
  ##########  Licensed under the MPL 2.0. Website: https://rabbitmq.com

  Doc guides: https://rabbitmq.com/documentation.html
  Support:    https://rabbitmq.com/contact.html
  Tutorials:  https://rabbitmq.com/getstarted.html
  Monitoring: https://rabbitmq.com/monitoring.html

  Logs: <stdout>

  Config file(s): /etc/rabbitmq/rabbitmq.conf

  Starting broker...2021-02-28 07:01:12.984 [info] <0.293.0> 
 node           : rabbitnode@my-rabbit
 home dir       : /var/lib/rabbitmq
 config file(s) : /etc/rabbitmq/rabbitmq.conf
 cookie hash    : q9NqwJsyvv/jgZQ/sZq+pg==
 log(s)         : <stdout>
 database dir   : /var/lib/rabbitmq/mnesia/rabbitnode@my-rabbit
2021-02-28 07:01:12.984 [warning] <0.293.0> Erlang VM is running with 1 I/O threads, file I/O performance may worsen
2021-02-28 07:01:13.226 [debug] <0.304.0> Lager installed handler lager_backend_throttle into lager_event
2021-02-28 07:01:13.523 [info] <0.293.0> Feature flags: list of feature flags found:
2021-02-28 07:01:13.523 [info] <0.293.0> Feature flags:   [ ] drop_unroutable_metric
2021-02-28 07:01:13.523 [info] <0.293.0> Feature flags:   [ ] empty_basic_get_metric
2021-02-28 07:01:13.523 [info] <0.293.0> Feature flags:   [ ] implicit_default_bindings
2021-02-28 07:01:13.523 [info] <0.293.0> Feature flags:   [ ] maintenance_mode_status
2021-02-28 07:01:13.523 [info] <0.293.0> Feature flags:   [ ] quorum_queue
2021-02-28 07:01:13.524 [info] <0.293.0> Feature flags:   [ ] user_limits
2021-02-28 07:01:13.524 [info] <0.293.0> Feature flags:   [ ] virtual_host_metadata
2021-02-28 07:01:13.524 [info] <0.293.0> Feature flags: feature flag states written to disk: yes
2021-02-28 07:01:15.953 [info] <0.293.0> Running boot step pre_boot defined by app rabbit
2021-02-28 07:01:15.953 [info] <0.293.0> Running boot step rabbit_core_metrics defined by app rabbit
2021-02-28 07:01:15.953 [info] <0.293.0> Running boot step rabbit_alarm defined by app rabbit
2021-02-28 07:01:15.957 [info] <0.375.0> Memory high watermark set to 1500 MiB (1572864000 bytes) of 11662 MiB (12228984832 bytes) total
2021-02-28 07:01:15.963 [info] <0.377.0> Enabling free disk space monitoring
2021-02-28 07:01:15.963 [info] <0.377.0> Disk free limit set to 50MB
2021-02-28 07:01:15.967 [info] <0.293.0> Running boot step code_server_cache defined by app rabbit
2021-02-28 07:01:15.967 [info] <0.293.0> Running boot step file_handle_cache defined by app rabbit
2021-02-28 07:01:15.967 [info] <0.380.0> Limiting to approx 1048479 file handles (943629 sockets)
2021-02-28 07:01:15.967 [info] <0.381.0> FHC read buffering:  OFF
2021-02-28 07:01:15.968 [info] <0.381.0> FHC write buffering: ON
2021-02-28 07:01:15.968 [info] <0.293.0> Running boot step worker_pool defined by app rabbit
2021-02-28 07:01:15.968 [info] <0.367.0> Will use 4 processes for default worker pool
2021-02-28 07:01:15.968 [info] <0.367.0> Starting worker pool 'worker_pool' with 4 processes in it
2021-02-28 07:01:15.969 [info] <0.293.0> Running boot step database defined by app rabbit
2021-02-28 07:01:15.970 [info] <0.293.0> Node database directory at /var/lib/rabbitmq/mnesia/rabbitnode@my-rabbit is empty. Assuming we need to join an existing cluster or initialise from scratch...
2021-02-28 07:01:15.970 [info] <0.293.0> Configured peer discovery backend: rabbit_peer_discovery_classic_config
2021-02-28 07:01:15.970 [info] <0.293.0> Will try to lock with peer discovery backend rabbit_peer_discovery_classic_config
2021-02-28 07:01:15.970 [info] <0.293.0> Peer discovery backend does not support locking, falling back to randomized delay
2021-02-28 07:01:15.970 [info] <0.293.0> Peer discovery backend rabbit_peer_discovery_classic_config does not support registration, skipping randomized startup delay.
2021-02-28 07:01:15.970 [info] <0.293.0> All discovered existing cluster peers: 
2021-02-28 07:01:15.970 [info] <0.293.0> Discovered no peer nodes to cluster with. Some discovery backends can filter nodes out based on a readiness criteria. Enabling debug logging might help troubleshoot.
2021-02-28 07:01:15.973 [info] <0.44.0> Application mnesia exited with reason: stopped
2021-02-28 07:01:15.973 [info] <0.44.0> Application mnesia exited with reason: stopped
2021-02-28 07:01:15.998 [info] <0.44.0> Application mnesia started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:16.252 [info] <0.293.0> Waiting for Mnesia tables for 30000 ms, 9 retries left
2021-02-28 07:01:16.252 [info] <0.293.0> Successfully synced tables from a peer
2021-02-28 07:01:16.283 [info] <0.293.0> Waiting for Mnesia tables for 30000 ms, 9 retries left
2021-02-28 07:01:16.283 [info] <0.293.0> Successfully synced tables from a peer
2021-02-28 07:01:16.283 [info] <0.293.0> Feature flag `drop_unroutable_metric`: supported, attempt to enable...
2021-02-28 07:01:16.283 [info] <0.293.0> Feature flag `drop_unroutable_metric`: mark as enabled=state_changing
2021-02-28 07:01:16.293 [info] <0.293.0> Feature flags: list of feature flags found:
2021-02-28 07:01:16.293 [info] <0.293.0> Feature flags:   [~] drop_unroutable_metric
2021-02-28 07:01:16.293 [info] <0.293.0> Feature flags:   [ ] empty_basic_get_metric
2021-02-28 07:01:16.294 [info] <0.293.0> Feature flags:   [ ] implicit_default_bindings
2021-02-28 07:01:16.294 [info] <0.293.0> Feature flags:   [ ] maintenance_mode_status
2021-02-28 07:01:16.294 [info] <0.293.0> Feature flags:   [ ] quorum_queue
2021-02-28 07:01:16.294 [info] <0.293.0> Feature flags:   [ ] user_limits
2021-02-28 07:01:16.294 [info] <0.293.0> Feature flags:   [ ] virtual_host_metadata
2021-02-28 07:01:16.294 [info] <0.293.0> Feature flags: feature flag states written to disk: yes
2021-02-28 07:01:16.308 [info] <0.293.0> Feature flag `drop_unroutable_metric`: mark as enabled=true
2021-02-28 07:01:16.323 [info] <0.293.0> Feature flags: list of feature flags found:
2021-02-28 07:01:16.323 [info] <0.293.0> Feature flags:   [x] drop_unroutable_metric
2021-02-28 07:01:16.323 [info] <0.293.0> Feature flags:   [ ] empty_basic_get_metric
2021-02-28 07:01:16.323 [info] <0.293.0> Feature flags:   [ ] implicit_default_bindings
2021-02-28 07:01:16.323 [info] <0.293.0> Feature flags:   [ ] maintenance_mode_status
2021-02-28 07:01:16.323 [info] <0.293.0> Feature flags:   [ ] quorum_queue
2021-02-28 07:01:16.323 [info] <0.293.0> Feature flags:   [ ] user_limits
2021-02-28 07:01:16.323 [info] <0.293.0> Feature flags:   [ ] virtual_host_metadata
2021-02-28 07:01:16.324 [info] <0.293.0> Feature flags: feature flag states written to disk: yes
2021-02-28 07:01:16.339 [info] <0.293.0> Feature flag `empty_basic_get_metric`: supported, attempt to enable...
2021-02-28 07:01:16.339 [info] <0.293.0> Feature flag `empty_basic_get_metric`: mark as enabled=state_changing
2021-02-28 07:01:16.351 [info] <0.293.0> Feature flags: list of feature flags found:
2021-02-28 07:01:16.352 [info] <0.293.0> Feature flags:   [x] drop_unroutable_metric
2021-02-28 07:01:16.352 [info] <0.293.0> Feature flags:   [~] empty_basic_get_metric
2021-02-28 07:01:16.352 [info] <0.293.0> Feature flags:   [ ] implicit_default_bindings
2021-02-28 07:01:16.352 [info] <0.293.0> Feature flags:   [ ] maintenance_mode_status
2021-02-28 07:01:16.352 [info] <0.293.0> Feature flags:   [ ] quorum_queue
2021-02-28 07:01:16.352 [info] <0.293.0> Feature flags:   [ ] user_limits
2021-02-28 07:01:16.352 [info] <0.293.0> Feature flags:   [ ] virtual_host_metadata
2021-02-28 07:01:16.352 [info] <0.293.0> Feature flags: feature flag states written to disk: yes
2021-02-28 07:01:16.368 [info] <0.293.0> Feature flag `empty_basic_get_metric`: mark as enabled=true
2021-02-28 07:01:16.383 [info] <0.293.0> Feature flags: list of feature flags found:
2021-02-28 07:01:16.384 [info] <0.293.0> Feature flags:   [x] drop_unroutable_metric
2021-02-28 07:01:16.384 [info] <0.293.0> Feature flags:   [x] empty_basic_get_metric
2021-02-28 07:01:16.384 [info] <0.293.0> Feature flags:   [ ] implicit_default_bindings
2021-02-28 07:01:16.384 [info] <0.293.0> Feature flags:   [ ] maintenance_mode_status
2021-02-28 07:01:16.384 [info] <0.293.0> Feature flags:   [ ] quorum_queue
2021-02-28 07:01:16.384 [info] <0.293.0> Feature flags:   [ ] user_limits
2021-02-28 07:01:16.384 [info] <0.293.0> Feature flags:   [ ] virtual_host_metadata
2021-02-28 07:01:16.384 [info] <0.293.0> Feature flags: feature flag states written to disk: yes
2021-02-28 07:01:16.399 [info] <0.293.0> Feature flag `implicit_default_bindings`: supported, attempt to enable...
2021-02-28 07:01:16.400 [info] <0.293.0> Feature flag `implicit_default_bindings`: mark as enabled=state_changing
2021-02-28 07:01:16.413 [info] <0.293.0> Feature flags: list of feature flags found:
2021-02-28 07:01:16.413 [info] <0.293.0> Feature flags:   [x] drop_unroutable_metric
2021-02-28 07:01:16.413 [info] <0.293.0> Feature flags:   [x] empty_basic_get_metric
2021-02-28 07:01:16.413 [info] <0.293.0> Feature flags:   [~] implicit_default_bindings
2021-02-28 07:01:16.413 [info] <0.293.0> Feature flags:   [ ] maintenance_mode_status
2021-02-28 07:01:16.413 [info] <0.293.0> Feature flags:   [ ] quorum_queue
2021-02-28 07:01:16.413 [info] <0.293.0> Feature flags:   [ ] user_limits
2021-02-28 07:01:16.413 [info] <0.293.0> Feature flags:   [ ] virtual_host_metadata
2021-02-28 07:01:16.413 [info] <0.293.0> Feature flags: feature flag states written to disk: yes
2021-02-28 07:01:16.429 [info] <0.293.0> Waiting for Mnesia tables for 30000 ms, 0 retries left
2021-02-28 07:01:16.429 [info] <0.293.0> Successfully synced tables from a peer
2021-02-28 07:01:16.429 [info] <0.293.0> Feature flag `implicit_default_bindings`: mark as enabled=true
2021-02-28 07:01:16.443 [info] <0.293.0> Feature flags: list of feature flags found:
2021-02-28 07:01:16.443 [info] <0.293.0> Feature flags:   [x] drop_unroutable_metric
2021-02-28 07:01:16.443 [info] <0.293.0> Feature flags:   [x] empty_basic_get_metric
2021-02-28 07:01:16.443 [info] <0.293.0> Feature flags:   [x] implicit_default_bindings
2021-02-28 07:01:16.443 [info] <0.293.0> Feature flags:   [ ] maintenance_mode_status
2021-02-28 07:01:16.443 [info] <0.293.0> Feature flags:   [ ] quorum_queue
2021-02-28 07:01:16.443 [info] <0.293.0> Feature flags:   [ ] user_limits
2021-02-28 07:01:16.443 [info] <0.293.0> Feature flags:   [ ] virtual_host_metadata
2021-02-28 07:01:16.443 [info] <0.293.0> Feature flags: feature flag states written to disk: yes
2021-02-28 07:01:16.457 [info] <0.293.0> Feature flag `maintenance_mode_status`: supported, attempt to enable...
2021-02-28 07:01:16.458 [info] <0.293.0> Feature flag `maintenance_mode_status`: mark as enabled=state_changing
2021-02-28 07:01:16.469 [info] <0.293.0> Feature flags: list of feature flags found:
2021-02-28 07:01:16.469 [info] <0.293.0> Feature flags:   [x] drop_unroutable_metric
2021-02-28 07:01:16.469 [info] <0.293.0> Feature flags:   [x] empty_basic_get_metric
2021-02-28 07:01:16.469 [info] <0.293.0> Feature flags:   [x] implicit_default_bindings
2021-02-28 07:01:16.470 [info] <0.293.0> Feature flags:   [~] maintenance_mode_status
2021-02-28 07:01:16.470 [info] <0.293.0> Feature flags:   [ ] quorum_queue
2021-02-28 07:01:16.470 [info] <0.293.0> Feature flags:   [ ] user_limits
2021-02-28 07:01:16.470 [info] <0.293.0> Feature flags:   [ ] virtual_host_metadata
2021-02-28 07:01:16.470 [info] <0.293.0> Feature flags: feature flag states written to disk: yes
2021-02-28 07:01:16.484 [info] <0.293.0> Creating table rabbit_node_maintenance_states for feature flag `maintenance_mode_status`
2021-02-28 07:01:16.488 [info] <0.293.0> Feature flag `maintenance_mode_status`: mark as enabled=true
2021-02-28 07:01:16.502 [info] <0.293.0> Feature flags: list of feature flags found:
2021-02-28 07:01:16.502 [info] <0.293.0> Feature flags:   [x] drop_unroutable_metric
2021-02-28 07:01:16.503 [info] <0.293.0> Feature flags:   [x] empty_basic_get_metric
2021-02-28 07:01:16.503 [info] <0.293.0> Feature flags:   [x] implicit_default_bindings
2021-02-28 07:01:16.503 [info] <0.293.0> Feature flags:   [x] maintenance_mode_status
2021-02-28 07:01:16.503 [info] <0.293.0> Feature flags:   [ ] quorum_queue
2021-02-28 07:01:16.503 [info] <0.293.0> Feature flags:   [ ] user_limits
2021-02-28 07:01:16.503 [info] <0.293.0> Feature flags:   [ ] virtual_host_metadata
2021-02-28 07:01:16.503 [info] <0.293.0> Feature flags: feature flag states written to disk: yes
2021-02-28 07:01:16.517 [info] <0.293.0> Feature flag `quorum_queue`: supported, attempt to enable...
defined by app rabbit
2021-02-28 07:01:16.974 [info] <0.293.0> Running boot step rabbit_priority_queue defined by app rabbit
2021-02-28 07:01:16.974 [info] <0.293.0> Priority queues enabled, real BQ is rabbit_variable_queue
2021-02-28 07:01:16.974 [info] <0.293.0> Running boot step rabbit_queue_location_client_local defined by app rabbit
2021-02-28 07:01:16.974 [info] <0.293.0> Running boot step rabbit_queue_location_min_masters defined by app rabbit
2021-02-28 07:01:16.974 [info] <0.293.0> Running boot step kernel_ready defined by app rabbit
2021-02-28 07:01:16.974 [info] <0.293.0> Running boot step rabbit_sysmon_minder defined by app rabbit
2021-02-28 07:01:16.974 [info] <0.293.0> Running boot step rabbit_epmd_monitor defined by app rabbit
2021-02-28 07:01:16.975 [info] <0.640.0> epmd monitor knows us, inter-node communication (distribution) port: 25672
2021-02-28 07:01:16.976 [info] <0.293.0> Running boot step guid_generator defined by app rabbit
2021-02-28 07:01:16.978 [info] <0.293.0> Running boot step rabbit_node_monitor defined by app rabbit
2021-02-28 07:01:16.978 [info] <0.644.0> Starting rabbit_node_monitor
2021-02-28 07:01:16.978 [info] <0.293.0> Running boot step delegate_sup defined by app rabbit
2021-02-28 07:01:16.980 [info] <0.293.0> Running boot step rabbit_memory_monitor defined by app rabbit
2021-02-28 07:01:16.980 [info] <0.293.0> Running boot step core_initialized defined by app rabbit
2021-02-28 07:01:16.980 [info] <0.293.0> Running boot step upgrade_queues defined by app rabbit
2021-02-28 07:01:17.011 [info] <0.293.0> message_store upgrades: 1 to apply
2021-02-28 07:01:17.011 [info] <0.293.0> message_store upgrades: Applying rabbit_variable_queue:move_messages_to_vhost_store
2021-02-28 07:01:17.011 [info] <0.293.0> message_store upgrades: No durable queues found. Skipping message store migration
2021-02-28 07:01:17.011 [info] <0.293.0> message_store upgrades: Removing the old message store data
2021-02-28 07:01:17.012 [info] <0.293.0> message_store upgrades: All upgrades applied successfully
2021-02-28 07:01:17.048 [info] <0.293.0> Running boot step channel_tracking defined by app rabbit
2021-02-28 07:01:17.085 [info] <0.293.0> Setting up a table for channel tracking on this node: 'tracked_channel_on_node_rabbitnode@my-rabbit'
2021-02-28 07:01:17.090 [info] <0.293.0> Setting up a table for channel tracking on this node: 'tracked_channel_table_per_user_on_node_rabbitnode@my-rabbit'
2021-02-28 07:01:17.091 [info] <0.293.0> Running boot step rabbit_channel_tracking_handler defined by app rabbit
2021-02-28 07:01:17.091 [info] <0.293.0> Running boot step connection_tracking defined by app rabbit
2021-02-28 07:01:17.095 [info] <0.293.0> Setting up a table for connection tracking on this node: 'tracked_connection_on_node_rabbitnode@my-rabbit'
2021-02-28 07:01:17.098 [info] <0.293.0> Setting up a table for per-vhost connection counting on this node: 'tracked_connection_per_vhost_on_node_rabbitnode@my-rabbit'
2021-02-28 07:01:17.101 [info] <0.293.0> Setting up a table for per-user connection counting on this node: 'tracked_connection_table_per_user_on_node_rabbitnode@my-rabbit'
2021-02-28 07:01:17.102 [info] <0.293.0> Running boot step rabbit_connection_tracking_handler defined by app rabbit
2021-02-28 07:01:17.102 [info] <0.293.0> Running boot step rabbit_exchange_parameters defined by app rabbit
2021-02-28 07:01:17.102 [info] <0.293.0> Running boot step rabbit_mirror_queue_misc defined by app rabbit
2021-02-28 07:01:17.103 [info] <0.293.0> Running boot step rabbit_policies defined by app rabbit
2021-02-28 07:01:17.104 [info] <0.293.0> Running boot step rabbit_policy defined by app rabbit
2021-02-28 07:01:17.104 [info] <0.293.0> Running boot step rabbit_queue_location_validator defined by app rabbit
2021-02-28 07:01:17.105 [info] <0.293.0> Running boot step rabbit_quorum_memory_manager defined by app rabbit
2021-02-28 07:01:17.105 [info] <0.293.0> Running boot step rabbit_vhost_limit defined by app rabbit
2021-02-28 07:01:17.105 [info] <0.293.0> Running boot step rabbit_mgmt_reset_handler defined by app rabbitmq_management
2021-02-28 07:01:17.105 [info] <0.293.0> Running boot step rabbit_mgmt_db_handler defined by app rabbitmq_management_agent
2021-02-28 07:01:17.105 [info] <0.293.0> Management plugin: using rates mode 'basic'
2021-02-28 07:01:17.106 [info] <0.293.0> Running boot step recovery defined by app rabbit
2021-02-28 07:01:17.107 [info] <0.293.0> Running boot step empty_db_check defined by app rabbit
2021-02-28 07:01:17.107 [info] <0.293.0> Will seed default virtual host and user...
2021-02-28 07:01:17.108 [info] <0.293.0> Adding vhost 'test' (description: 'Default virtual host')
2021-02-28 07:01:17.159 [info] <0.703.0> Making sure data directory '/var/lib/rabbitmq/mnesia/rabbitnode@my-rabbit/msg_stores/vhosts/KDISMNX5MOYU6Q6PZT8TQDPY' for vhost 'test' exists
2021-02-28 07:01:17.198 [info] <0.703.0> Starting message stores for vhost 'test'
2021-02-28 07:01:17.199 [info] <0.707.0> Message store "KDISMNX5MOYU6Q6PZT8TQDPY/msg_store_transient": using rabbit_msg_store_ets_index to provide index
2021-02-28 07:01:17.202 [info] <0.703.0> Started message store of type transient for vhost 'test'
2021-02-28 07:01:17.202 [info] <0.711.0> Message store "KDISMNX5MOYU6Q6PZT8TQDPY/msg_store_persistent": using rabbit_msg_store_ets_index to provide index
2021-02-28 07:01:17.204 [warning] <0.711.0> Message store "KDISMNX5MOYU6Q6PZT8TQDPY/msg_store_persistent": rebuilding indices from scratch
2021-02-28 07:01:17.206 [info] <0.703.0> Started message store of type persistent for vhost 'test'
2021-02-28 07:01:17.211 [info] <0.293.0> Created user 'admin'
2021-02-28 07:01:17.212 [info] <0.293.0> Successfully set user tags for user 'admin' to [administrator]
2021-02-28 07:01:17.214 [info] <0.293.0> Successfully set permissions for 'admin' in virtual host 'test' to '.*', '.*', '.*'
2021-02-28 07:01:17.214 [info] <0.293.0> Running boot step rabbit_looking_glass defined by app rabbit
2021-02-28 07:01:17.214 [info] <0.293.0> Running boot step rabbit_core_metrics_gc defined by app rabbit
2021-02-28 07:01:17.214 [info] <0.293.0> Running boot step background_gc defined by app rabbit
2021-02-28 07:01:17.214 [info] <0.293.0> Running boot step routing_ready defined by app rabbit
2021-02-28 07:01:17.215 [info] <0.293.0> Running boot step pre_flight defined by app rabbit
2021-02-28 07:01:17.215 [info] <0.293.0> Running boot step notify_cluster defined by app rabbit
2021-02-28 07:01:17.215 [info] <0.293.0> Running boot step networking defined by app rabbit
2021-02-28 07:01:17.215 [info] <0.293.0> Running boot step definition_import_worker_pool defined by app rabbit
2021-02-28 07:01:17.215 [info] <0.367.0> Starting worker pool 'definition_import_pool' with 4 processes in it
2021-02-28 07:01:17.216 [info] <0.293.0> Running boot step cluster_name defined by app rabbit
2021-02-28 07:01:17.216 [info] <0.293.0> Initialising internal cluster ID to 'rabbitmq-cluster-id-s3Rlj_-PGcjUKd7XYxR0Zg'
2021-02-28 07:01:17.246 [info] <0.293.0> Running boot step direct_client defined by app rabbit
2021-02-28 07:01:17.247 [info] <0.293.0> Running boot step rabbit_management_load_definitions defined by app rabbitmq_management
2021-02-28 07:01:17.247 [info] <0.744.0> Resetting node maintenance status
2021-02-28 07:01:17.248 [info] <0.44.0> Application rabbit started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:17.258 [info] <0.44.0> Application rabbitmq_management_agent started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:17.258 [info] <0.44.0> Application cowlib started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:17.258 [info] <0.44.0> Application cowboy started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:17.259 [info] <0.44.0> Application rabbitmq_web_dispatch started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:17.259 [info] <0.44.0> Application amqp_client started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:17.296 [info] <0.803.0> Management plugin: HTTPS listener started on port 15671
2021-02-28 07:01:17.296 [info] <0.911.0> Statistics database started.
2021-02-28 07:01:17.296 [info] <0.910.0> Starting worker pool 'management_worker_pool' with 3 processes in it
2021-02-28 07:01:17.297 [info] <0.44.0> Application rabbitmq_management started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:17.324 [info] <0.44.0> Application prometheus started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:17.328 [info] <0.924.0> Prometheus metrics: HTTP (non-TLS) listener started on port 15692
2021-02-28 07:01:17.329 [info] <0.44.0> Application rabbitmq_prometheus started on node 'rabbitnode@my-rabbit'
2021-02-28 07:01:17.328 [info] <0.744.0> Ready to start client connection listeners
2021-02-28 07:01:17.331 [info] <0.1043.0> started TCP listener on [::]:5672
2021-02-28 07:01:17.334 [info] <0.1060.0> started TLS (SSL) listener on [::]:5671
2021-02-28 07:01:17.734 [info] <0.744.0> Server startup complete; 4 plugins started.
 * rabbitmq_prometheus
 * rabbitmq_management
 * rabbitmq_web_dispatch
 * rabbitmq_management_agent
 completed with 4 plugins.
2021-02-28 07:01:17.734 [info] <0.744.0> Resetting node maintenance status

Above logs, output shows container is listening on tls/ssl port 5671, plain(without tls) port 5672 and tls management port 15671

and if do telnet on those open ports, I got below output

ubuntu@ubuntu-ThinkPad-X230-Tablet:~$ telnet localhost 5672
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.



ubuntu@ubuntu-ThinkPad-X230-Tablet:~$ telnet localhost 5671
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.

ubuntu@ubuntu-ThinkPad-X230-Tablet:~$ telnet localhost 15671
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.

As we can see from the above output rabbit container connection is getting closed on 5671 and 15671 ports by the foreign host and not getting closed on port 5672.

and if I check the status of rabbitmq or try to add new user inside rabbitmq container I got the below errors.

ubuntu@ubuntu-ThinkPad-X230-Tablet:~$ docker exec $(docker ps -q -f name=some-rabbit) rabbitmqctl add_user test_user test_password

ubuntu@ubuntu-ThinkPad-X230-Tablet:~$ docker exec some-rabbit rabbitmqctl status
RABBITMQ_ERLANG_COOKIE env variable support is deprecated and will be REMOVED in a future version. Use the $HOME/.erlang.cookie file or the --erlang-cookie switch instead.
Error: unable to perform an operation on node 'rabbitnode@my-rabbit'. Please see diagnostics information and suggestions below.

Most common reasons for this are:

 * Target node is unreachable (e.g. due to hostname resolution, TCP connection or firewall issues)
 * CLI tool fails to authenticate with the server (e.g. due to CLI tool's Erlang cookie not matching that of the server)
 * Target node is not running

In addition to the diagnostics info below:

 * See the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more
 * Consult server logs on node rabbitnode@my-rabbit
 * If target node is configured to use long node names, don't forget to use --longnames with CLI tools

DIAGNOSTICS
===========

attempted to contact: ['rabbitnode@my-rabbit']

rabbitnode@my-rabbit:
  * connected to epmd (port 4369) on my-rabbit
  * epmd reports node 'rabbitnode' uses port 25672 for inter-node and CLI tool traffic 
  * TCP connection succeeded but Erlang distribution failed 
  * suggestion: check if the Erlang cookie identical for all server nodes and CLI tools
  * suggestion: check if all server nodes and CLI tools use consistent hostnames when addressing each other
  * suggestion: check if inter-node connections may be configured to use TLS. If so, all nodes and CLI tools must do that
   * suggestion: see the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more


Current node details:
 * node name: 'rabbitmqcli-727-rabbitnode@my-rabbit'
 * effective user's home directory: /var/lib/rabbitmq
 * Erlang cookie hash: q9NqwJsyvv/jgZQ/sZq+pg==

So what's gone wrong from my side that

connection on ssl/tls ports 5671 and 15671 are getting closed by the foreign host
show status inside rabbitmq container throws second error(Error: unable to perform an operation on node 'rabbitnode@my-rabbit'). I need to resolve this error as it's absolutely necessary for me to create a new user and set right permissions to it using below command

docker exec $(docker ps -q -f name=some-rabbit) rabbitmqctl add_user test_user test_password

docker exec $(docker ps -q -f name=some-rabbit) rabbitmqctl set_permissions -p test test_user "" ".*" ".*"

I have used this link(https://www.rabbitmq.com/ssl.html) guide to get SSL certificates.

Can someone please throw some light on this as to why it's happening like this and how to resolve this issue and enable SSL/TLS in rabbitmq?

wglambert · 2021-03-01T16:05:10Z

wglambert
Mar 1, 2021

Your variables are typo'd: RABBITMQ_SSL_CERT_FILE, RABBITMQ_SSL_KEY_FILE, RABBITMQ_SSL_CA_FILE
Shouldn't have the _ before FILE, so: RABBITMQ_SSL_CERTFILE, RABBITMQ_SSL_KEYFILE, RABBITMQ_SSL_CAFILE
https://github.com/docker-library/docs/tree/master/rabbitmq#environment-variables

Following the example at https://www.rabbitmq.com/ssl.html#automated-certificate-generation-transcript I was able to get ssl working #376 (comment)

0 replies

michaelklishin · 2021-03-11T00:51:39Z

michaelklishin
Mar 11, 2021
Collaborator

  * TCP connection succeeded but Erlang distribution failed 
  * suggestion: check if the Erlang cookie identical for all server nodes and CLI tools
  * suggestion: check if all server nodes and CLI tools use consistent hostnames when addressing each other
  * suggestion: check if inter-node connections may be configured to use TLS. If so, all nodes and CLI tools must do that
   * suggestion: see the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more

are not related to TLS but also the lines you are looking for. How CLI Tools Authenticate to RabbitMQ Nodes, Troubleshooting Shared Secret Authentication explain what is going on and what you should do.

Instead of using environment variables, consider using rabbitmq.conf entries as explained in the TLS guide.

Specifically in this case of using CLI tools from a host while RabbitMQ is running in a container, CLI tools support an --erlang-cookie [value] argument which can be used for one-off calls. This option has obvious downsides in terms of security so putting the shared secret (cookie) file to the expected location in the host is a much better idea.

0 replies

michaelklishin · 2021-03-11T00:53:20Z

michaelklishin
Mar 11, 2021
Collaborator

@wgerlach I think you folks should move such questions to Discussions (currently in beta but GitHub should enable them if you ask) or at least close them after providing an answer.

1 reply

tianon Mar 17, 2021
Maintainer

Good idea -- we'll use this repo as a test for whether we want to enable those elsewhere too. 😄

(This is now a discussion instead of an issue 👍)

jaschaio · 2021-03-15T22:09:40Z

jaschaio
Mar 15, 2021

I am having a very similar issue.

But I am trying to set up a cluster with 3 nodes.

The clustering works for all nodes that use rabbitmq:3.8.11 but the node running rabbitmq:3.8.11-management fails to connect to the cluster.

What is interesting is that rabbitmqctl commands fail within the management container as well with a similar error as @devopsenggineer reported:

Error: unable to perform an operation on node 'rabbit@rabbit-01'. Please see diagnostics information and suggestions below.

Most common reasons for this are:

 * Target node is unreachable (e.g. due to hostname resolution, TCP connection or firewall issues)
 * CLI tool fails to authenticate with the server (e.g. due to CLI tool's Erlang cookie not matching that of the server)
 * Target node is not running

In addition to the diagnostics info below:

 * See the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more
 * Consult server logs on node rabbit@rabbit-01
 * If target node is configured to use long node names, don't forget to use --longnames with CLI tools

DIAGNOSTICS
===========

attempted to contact: ['rabbit@rabbit-01']

rabbit@rabbit-01:
  * connected to epmd (port 4369) on rabbit-01
  * epmd reports node 'rabbit' uses port 25672 for inter-node and CLI tool traffic
  * TCP connection succeeded but Erlang distribution failed
  * suggestion: check if the Erlang cookie identical for all server nodes and CLI tools
  * suggestion: check if all server nodes and CLI tools use consistent hostnames when addressing each other
  * suggestion: check if inter-node connections may be configured to use TLS. If so, all nodes and CLI tools must do that
   * suggestion: see the CLI, clustering and networking guides on https://rabbitmq.com/documentation.html to learn more


Current node details:
 * node name: 'rabbitmqcli-519-rabbit@rabbit-01'
 * effective user's home directory: /var/lib/rabbitmq
 * Erlang cookie hash: Wshq4WD2GY7JmGLpnfzYnA==

It seems that I was able to resolve this error by setting both the RABBITMQ_SSL_ and RABBITMQ_MANAGEMENT_SSL_ environment variables on the management container.

It displays as well the other nodes now in the management UI, but it says Node statistics not available. Is this expected if I only run a single node with the management plugin?

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

how to enable SSL/TLS in rabbitmq for rabbitmq:3-management docker image. #470

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 4 comments 1 reply

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

how to enable SSL/TLS in rabbitmq for rabbitmq:3-management docker image. #470

devopsenggineer Feb 28, 2021

Replies: 4 comments · 1 reply

wglambert Mar 1, 2021

michaelklishin Mar 11, 2021 Collaborator

michaelklishin Mar 11, 2021 Collaborator

tianon Mar 17, 2021 Maintainer

jaschaio Mar 15, 2021

devopsenggineer
Feb 28, 2021

Replies: 4 comments 1 reply

wglambert
Mar 1, 2021

michaelklishin
Mar 11, 2021
Collaborator

michaelklishin
Mar 11, 2021
Collaborator

tianon Mar 17, 2021
Maintainer

jaschaio
Mar 15, 2021