This guide will focus on the first option. Use a proxy or load balancer (such as HAproxy) to perform TLS termination of client connections and use plain TCP connections to RabbitMQ nodes.īoth approaches are valid and have pros and cons.Configure RabbitMQ to handle TLS connections.Common Approaches to TLS for client Connections with RabbitMQįor client connections, there are two common approaches: To configure TLS on Kubernetes using the RabbitMQ Cluster Operator, see the guide for Configuring TLS.įor an overview of common TLS troubleshooting techniques, see Troubleshooting TLS-related issues and Troubleshooting Networking. HTTP API, inter-node and CLI tool traffic can be configured to use TLS (HTTPS) as well.

TLS can be enabled for all protocols supported by RabbitMQ, not just AMQP 0-9-1, which this guide focuses on. It tries to explain the basics of TLS but not, however, a primer on TLS, encryption, public Key Infrastructure and related topics, so the concepts are covered very briefly.Ī number of beginner-oriented primers are available elsewhere on the Web: one two, three, four.

Known attacks on TLS and their mitigationĪnd more.

Tools that can be used to evaluate a TLS setup.

How to control what TLS version and cipher suite are enabled.

Public key usage extensions relevant to RabbitMQ.

Peer (certificate chain) verification of client connections or mutual ('mTLS').

How to generate self-signed certificates for development and QA environments with tls-gen or manually.

Erlang/OTP requirements for TLS support.

Two ways of using TLS for client connections: direct or via a TLS terminating proxy.

This guide covers various topics related to TLS in RabbitMQ, with a focus on client connections: It is also possible to use TLS to encrypt inter-node connections in clusters.

This includes client connections and popular plugins, where applicable, such as Federation links.

Rabbitmq java client ssl tls2 example