Rabbitmq: SSL authentication with docker compose.

[manuelteillet]

Hello.

I'm trying to run a rabbitmq container from docker compose with ssl authentication.

Here is my docker.compose.yml

version: '2'
services:
  rabbitmq:
    tty: true
    hostname: my-rabbit
    ports:
      - "15672:15672"
      - "15671:15671"
      - "5672:5672"
      - "5671:5671"
    image: rabbitmq:3-management
    environment:
      - RABBITMQ_SSL_CERTFILE=/cert_rabbitmq/testca/cacert.pem
      - RABBITMQ_SSL_KEYFILE=/cert_rabbitmq/server/cert.pem
      - RABBITMQ_SSL_CACERTFILE=/cert_rabbitmq/server/key.pem
      - RABBITMQ_DEFAULT_USER=user
      - RABBITMQ_DEFAULT_PASS=password
    volumes:
      - ./cert_rabbitmq:/cert_rabbitmq

  client:
    tty: true
    image: debian:jessie
    command: bash
    volumes:
      - ./cert_rabbitmq:/cert_rabbitmq

When I start my containers with docker-compose up, I get the following log that seems correct to me (I removed 'Statistics garbage collector' lines to keep it shorter)

rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:58 ===
rabbitmq_1  | Starting RabbitMQ 3.6.5 on Erlang 19.0.7
rabbitmq_1  | Copyright (C) 2007-2016 Pivotal Software, Inc.
rabbitmq_1  | Licensed under the MPL.  See http://www.rabbitmq.com/
rabbitmq_1  | 
rabbitmq_1  |               RabbitMQ 3.6.5. Copyright (C) 2007-2016 Pivotal Software, Inc.
rabbitmq_1  |   ##  ##      Licensed under the MPL.  See http://www.rabbitmq.com/
rabbitmq_1  |   ##  ##
rabbitmq_1  |   ##########  Logs: tty
rabbitmq_1  |   ######  ##        tty
rabbitmq_1  |   ##########
rabbitmq_1  |               Starting broker...
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:58 ===
rabbitmq_1  | node           : rabbit@my-rabbit
rabbitmq_1  | home dir       : /var/lib/rabbitmq
rabbitmq_1  | config file(s) : /etc/rabbitmq/rabbitmq.config
rabbitmq_1  | cookie hash    : kqHJWQpPpNUEv7vcY+Qneg==
rabbitmq_1  | log            : tty
rabbitmq_1  | sasl log       : tty
rabbitmq_1  | database dir   : /var/lib/rabbitmq/mnesia/rabbit@my-rabbit
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Memory limit set to 6338MB of 15846MB total.
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Disk free limit set to 50MB
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Limiting to approx 65436 file handles (58890 sockets)
rabbitmq_1  | 
rabbitmq_1  | =INFO REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | FHC read buffering:  OFF
rabbitmq_1  | FHC write buffering: ON
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Priority queues enabled, real BQ is rabbit_variable_queue
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Management plugin: using rates mode 'basic'
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | msg_store_transient: using rabbit_msg_store_ets_index to provide index
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | msg_store_persistent: using rabbit_msg_store_ets_index to provide index
rabbitmq_1  | NG REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | msg_store_persistent: rebuilding indices from scratch
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | started SSL Listener on [::]:5671
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Management plugin started. Port: 15671
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Statistics event collector started.
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Statistics channel stats collector started.
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Statistics queue stats collector started.
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Statistics database started.
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Statistics garbage collector started for table aggr_queue_stats_fine_stats with interval 5000.
rabbitmq_1  | ed with 6 plugins.
rabbitmq_1  | REPORT==== 17-Oct-2016::09:34:59 ===
rabbitmq_1  | Statistics garbage collector started for table aggr_queue_exchange_stats_fine_stats with interval 5000.
rabbitmq_1  | 
rabbitmq_1  | =INFO REPORT==== 17-Oct-2016::09:34:59 === startup complete; 6 plugins started.
rabbitmq_1  |  * rabbitmq_management
rabbitmq_1  |  * rabbitmq_web_dispatch
rabbitmq_1  |  * webmachine
rabbitmq_1  |  * mochiweb
rabbitmq_1  |  * rabbitmq_management_agent
rabbitmq_1  |  * amqp_client

But when I try to connect from the client container:

openssl s_client -connect rabbitmq:5671 -cert /cert_rabbitmq/client/cert.pem -key /cert_rabbitmq/client/key.pem -CAfile /cert_rabbitmq/testca/cacert.pem
CONNECTED(00000003)

And no logs on rabbitmq.

And when I try to connect to the managment url, I get an ERR_CONNECTION_RESET and rabbitmq logs are:

rabbitmq_1  | =ERROR REPORT==== 17-Oct-2016::10:16:17 ===
rabbitmq_1  |     application: mochiweb
rabbitmq_1  |     "Accept failed error"
rabbitmq_1  |     "{error,{keyfile,{badmatch,[]}}}"
rabbitmq_1  | 
rabbitmq_1  | =CRASH REPORT==== 17-Oct-2016::10:16:17 ===
rabbitmq_1  |   crasher:
rabbitmq_1  |     initial call: mochiweb_acceptor:init/4
rabbitmq_1  |     pid: <0.4501.0>
rabbitmq_1  |     registered_name: []
rabbitmq_1  |     exception exit: {error,accept_failed}
rabbitmq_1  |       in function  mochiweb_acceptor:init/4 (src/mochiweb_acceptor.erl, line 73)
rabbitmq_1  |     ancestors: [rabbit_web_dispatch_sup_15671,rabbit_web_dispatch_sup,
rabbitmq_1  |                   <0.335.0>]
rabbitmq_1  |     messages: []
rabbitmq_1  |     links: [<0.342.0>]
rabbitmq_1  |     dictionary: []
rabbitmq_1  |     trap_exit: false
rabbitmq_1  |     status: running
rabbitmq_1  |     heap_size: 1598
rabbitmq_1  |     stack_size: 27
rabbitmq_1  |     reductions: 847
rabbitmq_1  |   neighbours:

But if I start the container with
sudo docker run --name rabbitmq --hostname my-rabbit -p 5671:5671 -p 5672:5672 -p 15671:15671 -p 15672:15672 -e RABBITMQ_SSL_CERT_FILE=/cert_rabbitmq/server/cert.pem -e RABBITMQ_SSL_KEY_FILE=/cert_rabbitmq/server/key.pem -e RABBITMQ_SSL_CA_FILE=/cert_rabbitmq/testca/cacert.pem -e RABBITMQ_DEFAULT_USER=user -e RABBITMQ_DEFAULT_PASS=password -v /home/user/rabbitmq_docker/cert_rabbitmq:/cert_rabbitmq rabbitmq:3-management

then the container starts with no problem and I can access rabbitmq and the management interface.

Is there something wrong with my setup ? Are there some differences between docker compose and docker run that i'm not aware of ?

Thanks for your answers.

[jerryz1982]

  - RABBITMQ_SSL_CERTFILE=/cert_rabbitmq/testca/cacert.pem
  - RABBITMQ_SSL_KEYFILE=/cert_rabbitmq/server/cert.pem
  - RABBITMQ_SSL_CACERTFILE=/cert_rabbitmq/server/key.pem

You pointed to the wrong file. from the file name, i suspect that cacert.pem is cacertfile, cert.pem is cert file and key.pem is keyfile.

[michaelklishin]

@jerryz1982's comment above seems to be spot on. The error says that Mochiweb, the HTTP API server used up to 3.6.6, cannot load the key file.