Load new cert without restart

[Carl Hörberg]

We have to install a new TLS cert on a couple of servers, because the old is soon expiring. Is there a way to tell erlang/rabbitmq to load the new key/cert-chain without restart the whole server?

[Michael Klishin]

I believe the OTP ssl app doesn't let you do that as it caches stuff internally. I may be wrong, though.

MK

On 28/1/2015, at 13:56, Carl Hörberg <ca...@cloudamqp.com> wrote:

We have to install a new TLS cert on a couple of servers, because the old is soon expiring. Is there a way to tell erlang/rabbitmq to load the new key/cert-chain without restart the whole server?

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-user...@googlegroups.com.
To post to this group, send email to rabbitm...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Carl Hörberg]

Yes, with: rabbitmqctl eval 'ssl:stop(), ssl:start().'

[Michael Klishin]

Nice. Does this drop existing connections?

MK

[Carl Hörberg]

Yes, it does drop existing connections unfortunately (and Ruby Bunny isn't able to automatically recover(?) but issuing b.start again reconnects properly :/ ) 

--

You received this message because you are subscribed to a topic in the Google Groups "rabbitmq-users" group.

To unsubscribe from this topic, visit https://groups.google.com/d/topic/rabbitmq-users/vrucUTvDUAA/unsubscribe.

To unsubscribe from this group and all its topics, send an email to rabbitmq-user...@googlegroups.com.

To post to this group, send an email to rabbitm...@googlegroups.com.

[Michael Klishin]

I am curious what kind of exception Ruby throws in that case, Bunny handles a broad group of network and system call exceptions.

MK

[Carl Hörberg]

Actually, ignore the Bunny thing, might looks like it was a continuation timeout, and not a TLS problem that tripped Bunny. (The connection was closed though when issuing ssl:stop/start)

[Arun Kumar]

Hi,

Thank you for the command. After running the command rabbitmqctl eval "ssl:stop(), ssl:start()". the connections drops.  Can you please share the windows command to recover the connections / channels etc ? I could not understand how to use b.start  from your previous comment. 

[Michael Klishin]

Carl was referring to Bunny::Session#start that initiates client connection.

There seem to have been some changes in recent Erlang releases that introduce potential for certificate and key reloading

in the `ssl` app which RabbitMQ uses. See https://groups.google.com/d/msg/rabbitmq-users/AdkDZhmYtAA/wI_etbl_BAAJ.

We don't yet know if it's a documented feature and what version introduced it.