Help with Creating Full-Chain Certificate for RabbitMQ

Help
1

I am currently using a certificate issued by Let's Encrypt for my RabbitMQ server. However, I am having trouble configuring the SSL setup because I need to generate the full-chain certificate to use with RabbitMQ.

Could you please guide me on how to create a full-chain certificate from the files I have received? Specifically, I need to know how to combine the certificate with the intermediate and root certificates to generate the full-chain that RabbitMQ can use.

Here are the files I currently have:

  • rabbitmq.deponet.ir-crt.pem (server certificate)
  • rabbitmq.deponet.ir-chain-only.pem (chain certificate, containing intermediate certificates)

Once I have the full-chain certificate, I plan to configure RabbitMQ by setting ssl_options.cacertfile to the path of this new full-chain certificate.

I would appreciate your help in guiding me through the process.

Thank you for your time and assistance.

Best regards,
Nasser Fallahzadeh

2

The "full chain" file you describe is the collection of trusted CA root certificates on your system. They are not related to the cert file you received from Let's Encrypt.

What those are, exactly, varies depending on your o/s and other system settings.

We don't see RabbitMQ much on this forum. This seems like a question better directed at a RabbitMQ forum or their github.

Perhaps someone else here will be familiar with that and offer help. While we often help configure common servers on commonly used operating systems we do not focus on providing help for every possible TLS situation.

That said, for anyone to help you we would need the answers to the other questions you were shown when posting in the Help topic. Especially the section about your o/s and its version and the ACME Client you used and its version. See original form below

A link to the instructions you are following for configuring RabbitMQ would be helpful too. I quickly reviewed their site and there are many places that talk about this configuration.

Please also clarify if you are trying to setup mTLS or just TLS

=====================================

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

3 Likes
3

How did you get those files? I.e., which ACME client did you use?

Also, the documentation at TLS Support | RabbitMQ is highly confusing and, IMO, not well structured. I have absolutely no clue what the purpose of ssl_options.cacertfile is: is it just for client authentication or does RabbitMQ somehow use the CA cert (bundle) to validate the configured server certificate chain? Or does it use that option for the chain? Including the roo? Excluding the root? So many questions...

And another question: do you actually need your RabbitMQ server to be TLS encrypted? I.e.: are you using it over the public internet? Because if it's just internal on a secure network, why bother?

3 Likes
4

Defense in depth. Encrypt all of the things. The LAN is not exempt from encrypting all traffic. Trust nothing. Verify everything.

It also makes it a lot easier to know if you need to configure HTTPS when you always use HTTPS.

That said, you have highlighted some aspects of the RabbitMQ documentation that could stand some improvement.

4 Likes
5

I wanted to use the files generated by win-acme for RabbitMQ to enable SSL. However, after using the key, chain-only, and cert files in the following configuration, SSL is still not working for RabbitMQ:

ini

CopyEdit

ssl_options.certfile = C:\Needed Software\RabbitMQCertificate\rabbitmq.deponet.ir-crt.pem
ssl_options.keyfile = C:\Needed Software\RabbitMQCertificate\rabbitmq.deponet.ir-key.pem
ssl_options.cacertfile = C:\Needed Software\RabbitMQCertificate\rabbitmq.deponet.ir-chain-only.pem
6

Try using the full chain file (probably called rabbitmq.deponet.ir-chain.pem as your certfile.

Also set your paths using forward slash e.g.
ssl_options.certfile = C:/Needed Software/RabbitMQCertificate/rabbitmq.deponet.ir-crt.pem

Otherwise according to their docs the path will get escaped on windows:TLS Support | RabbitMQ

2 Likes
7

In addition to that you should probably put quotes around the path. You have imbedded spaces and usually quotes are needed for that. Maybe RabbitMQ parses it without but it is something to try.

If you want more help from us please describe the details of what you mean by this

3 Likes
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.