TLS/SSL encryption in RabbitMQ - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

RabbitMQ TLS handshake failure output

You have configured RabbitMQ to use TLS but the client fails to connect. What output will you see in the RabbitMQ logs when a TLS handshake fails due to a certificate mismatch?

A [error] TLS: client: In state hello received SERVER ALERT: Fatal - Bad Certificate

B [info] TLS: client: Connection established successfully

C [warning] TLS: client: Certificate verified successfully

D [error] TLS: client: Connection closed by peer without handshake

💡 Hint

Look for error messages related to TLS handshake and certificate issues.

When a TLS handshake fails due to certificate mismatch, RabbitMQ logs a fatal alert with 'Bad Certificate' indicating the client rejected the server certificate.

❓ Configuration

intermediate

Correct RabbitMQ TLS configuration snippet

Which of the following RabbitMQ configuration snippets correctly enables TLS on the default listener port 5671 with certificate files?

A

listeners.tcp = 5671
ssl_options.cacertfile = "/etc/rabbitmq/ca_certificate.pem"
ssl_options.certfile = "/etc/rabbitmq/server_certificate.pem"
ssl_options.keyfile = "/etc/rabbitmq/server_key.pem"

B

listeners.tcp = none
listeners.ssl.default = 5671
ssl_options.cacertfile = "/etc/rabbitmq/ca_certificate.pem"
ssl_options.certfile = "/etc/rabbitmq/server_certificate.pem"
ssl_options.keyfile = "/etc/rabbitmq/server_key.pem"
ssl_options.verify = verify_peer
ssl_options.fail_if_no_peer_cert = true

C

listeners.ssl.default = 5672
ssl_options.cacertfile = "/etc/rabbitmq/ca_certificate.pem"
ssl_options.certfile = "/etc/rabbitmq/server_certificate.pem"
ssl_options.keyfile = "/etc/rabbitmq/server_key.pem"

D

listeners.ssl.default = 5671
ssl_options.cacertfile = "/etc/rabbitmq/server_certificate.pem"
ssl_options.certfile = "/etc/rabbitmq/ca_certificate.pem"
ssl_options.keyfile = "/etc/rabbitmq/server_key.pem"

💡 Hint

Check the port number and the order of certificate files in ssl_options.

Port 5671 is the default TLS port. The CA certificate must be set in cacertfile, server cert in certfile, and private key in keyfile. TCP listener must be disabled to avoid conflicts.

❓ Troubleshoot

advanced

Diagnosing RabbitMQ TLS client connection error

A RabbitMQ client fails to connect over TLS with the error: "unable to verify the first certificate". What is the most likely cause?

A The client is using the wrong username or password

B The RabbitMQ server certificate has expired

C The RabbitMQ server is not listening on the TLS port

D The client does not trust the CA that signed the RabbitMQ server certificate

💡 Hint

Think about what "unable to verify the first certificate" means in TLS context.

This error means the client cannot verify the server certificate chain because it does not trust the CA that issued the server certificate.

🔀 Workflow

advanced

Order of steps to enable TLS on RabbitMQ

What is the correct order of steps to enable TLS encryption on a RabbitMQ server?

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 3,1,2,4

💡 Hint

Think about what must be done before configuring RabbitMQ and clients.

First generate certificates, then configure RabbitMQ, then distribute CA cert to clients, finally verify connections.

✅ Best Practice

expert

Best practice for RabbitMQ TLS private key security

Which of the following is the best practice to secure the RabbitMQ server private key used for TLS?

A Store the private key with strict file permissions and use an encrypted filesystem or hardware security module (HSM)

B Embed the private key directly in the RabbitMQ configuration file for easy access

C Store the private key on a public web server for backup

D Share the private key with all RabbitMQ clients to simplify setup

💡 Hint

Consider how to protect sensitive cryptographic material from unauthorized access.

Private keys must be protected with strict permissions and ideally stored encrypted or in hardware security modules to prevent compromise.