Rabbit SSL配置無法正常工作 - {ssl_upgrade_error，{tls_alert，“certificate unknown”}}

Question

我有兩個服務器，其中Rabbit mq正在運行並且是群集的。 我有一個CA簽名證書，這是在兩台服務器上配置的。 其中一台服務器已啟動並正在運行，但另一台服務器未提供證書未知錯誤。

我真的很困惑為什么同一組證書在一台服務器上工作而不在另一台服務器上工作。

[

  {rabbit, [
     {ssl_listeners, [ 5671]},
     {ssl_options, [{cacertfile,               "/etc/rabbitmq/certificates/RootCA.crt.pem"},
                        {certfile,             "/etc/rabbitmq/certificates/sserver_cert.pem"},
                        {keyfile,              "/etc/rabbitmq/certificates/server_key.pem"},
 {depth, 2},
                        {verify,verify_none},
                        {fail_if_no_peer_cert, false}]}
   ]}
].

Rabbit MQ和Erlang版本

{erlang_version,
     "Erlang/OTP 17 [erts-6.3] [source] [64-bit] [smp:4:4] [async-threads:30] [kernel-poll:true]\n"},

 [{rabbitmq_management,"RabbitMQ Management Console","3.5.3"},
      {rabbitmq_web_dispatch,"RabbitMQ Web Dispatcher","3.5.3"},
      {webmachine,"webmachine","1.10.3-rmq3.5.3-gite9359c7"},
      {mochiweb,"MochiMedia Web Server","2.7.0-rmq3.5.3-git680dba8"},
      {rabbitmq_management_agent,"RabbitMQ Management Agent","3.5.3"},
      {rabbit,"RabbitMQ","3.5.3"},

我在其中一個服務器上遇到的錯誤：

=ERROR REPORT==== 10-May-2016::20:21:52 ===
SSL: certify: ssl_alert.erl:92:Fatal error: certificate unknown

=ERROR REPORT==== 10-May-2016::20:21:52 ===
Error on AMQP connection <0.27744.2>:
{ssl_upgrade_error,{tls_alert,"unexpected message"}}

=ERROR REPORT==== 10-May-2016::20:21:52 ===
SSL: certify: ssl_alert.erl:92:Fatal error: unexpected message

=ERROR REPORT==== 10-May-2016::20:21:52 ===
Error on AMQP connection <0.27748.2>:
{ssl_upgrade_error,{tls_alert,"unexpected message"}}

=ERROR REPORT==== 10-May-2016::20:21:52 ===
SSL: certify: ssl_alert.erl:92:Fatal error: unexpected message

=ERROR REPORT==== 10-May-2016::20:21:53 ===
Error on AMQP connection <0.27752.2>:
{ssl_upgrade_error,{tls_alert,"certificate unknown"}}

=ERROR REPORT==== 10-May-2016::20:21:53 ===
SSL: certify: ssl_alert.erl:92:Fatal error: certificate unknown

Answer 1

我只有痛苦試圖讓兔子與TLS一起工作。

作為替代方案，我們最終使用stunnel（ https://www.stunnel.org/index.html ）並在客戶端和服務器端創建透明的隧道連接。

它實際上工作得很好，因為它具有不需要更改客戶端代碼的附加開發優勢，只需要更改它們所連接的網絡地址。