TLS/SSL encryption in RabbitMQ - Commands & Configuration

Introduction

TLS/SSL encryption protects data sent between RabbitMQ servers and clients by making it unreadable to outsiders. It helps keep messages safe from hackers or eavesdroppers.

When you want to secure message data between your app and RabbitMQ server over the internet.

When your RabbitMQ server handles sensitive information like passwords or personal data.

When compliance rules require encrypted communication for your messaging system.

When you want to prevent attackers from intercepting or tampering with messages.

When running RabbitMQ in a multi-tenant environment where isolation is important.

Config File - rabbitmq.conf

rabbitmq.conf

listeners.ssl.default = 5671
ssl_options.cacertfile = /etc/rabbitmq/certs/ca_certificate.pem
ssl_options.certfile = /etc/rabbitmq/certs/server_certificate.pem
ssl_options.keyfile = /etc/rabbitmq/certs/server_key.pem
ssl_options.verify = verify_peer
ssl_options.fail_if_no_peer_cert = true

This configuration enables RabbitMQ to listen on port 5671 with TLS encryption.

listeners.ssl.default sets the port for TLS connections.

ssl_options.cacertfile points to the trusted CA certificate file.

ssl_options.certfile is the server's public certificate.

ssl_options.keyfile is the server's private key.

ssl_options.verify enforces client certificate verification.

ssl_options.fail_if_no_peer_cert requires clients to present a certificate.

Commands

Stops the RabbitMQ application to safely apply configuration changes.

Terminal

sudo rabbitmqctl stop_app

Expected Output

Stopping rabbit application ...

Resets the RabbitMQ node to clear previous state before enabling TLS.

Terminal

sudo rabbitmqctl reset

Expected Output

Resetting node rabbit@localhost ...

Starts the RabbitMQ application with the new TLS configuration active.

Terminal

sudo rabbitmqctl start_app

Expected Output

Starting rabbit application ...

Tests the TLS connection to RabbitMQ on port 5671 using the CA certificate to verify the server.

Terminal

openssl s_client -connect localhost:5671 -CAfile /etc/rabbitmq/certs/ca_certificate.pem

Expected Output

CONNECTED(00000003)

depth=1 C = US, O = ExampleOrg, CN = ExampleCA

verify return:1

---

Certificate chain

 0 s:/CN=server.example.com

   i:/C=US/O=ExampleOrg/CN=ExampleCA

---

SSL handshake has read 1234 bytes and written 456 bytes

---

New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384

---

Server certificate

subject=/CN=server.example.com

issuer=/C=US/O=ExampleOrg/CN=ExampleCA

---

SSL-Session:

    Protocol  : TLSv1.2

    Cipher    : ECDHE-RSA-AES256-GCM-SHA384

    Session-ID: ...

    Verify return code: 0 (ok)

---

→

-connect - Specifies the server and port to connect to.

→

-CAfile - Specifies the CA certificate file to verify the server certificate.

Key Concept

If you remember nothing else from this pattern, remember: TLS encrypts RabbitMQ traffic to keep messages private and safe from attackers.

Common Mistakes

Not restarting RabbitMQ after changing TLS settings

RabbitMQ won't apply the new TLS configuration until it restarts, so connections remain unencrypted.

Always stop and start the RabbitMQ application after updating TLS settings.

Using incorrect file paths for certificates and keys

RabbitMQ fails to start TLS if it cannot find the certificate or key files.

Double-check file paths and permissions for all TLS certificate and key files.

Not verifying client certificates when required

Without client verification, unauthorized clients can connect, reducing security.

Set ssl_options.verify to verify_peer and ssl_options.fail_if_no_peer_cert to true to enforce client certs.

Summary

Configure RabbitMQ to use TLS by specifying certificate and key files in rabbitmq.conf.

Restart RabbitMQ application to apply TLS settings safely.

Test TLS connection using openssl s_client to ensure encryption is active and certificates are valid.