RMQ 4.2.4 and Load Balancer SSL

[Sravani Cheruvu]

Hi Team ,

We are having a Load balancer VIP with 3 backend servers , where RabbitMQ 4.2.4 has been installed.

TLS version1.2 is enabled on all the three RMQ servers and LB as well.

When Load balancer VIP is configured with SSL_TCP , python client using TLS1.2 is not able to connect to RabbitMQ servers via LB and  sees SSL handshake errors or incorrect protocol usage errors.

At the same time when the LB is configured with SSL_BRIDGE , the same python client gets through LB and connects to Rabbit MQ servers (4.2.4) .

Before upgrade RabbitMQ 3.12.13 servers , same python client used to get connected to LB and underlying servers when the same LB is configured with SSL_TCP

Could you please let us know why RMQ 3.12 is working when LB is configured with SSL_TCP and RMQ 4.2.4 is working only when LB is configured with SSL_BRIDGE. 

Attaching the snapshot of rmq.conf at server side

Thanks & Regards

Lakshmi Sravani

[Mirah Gary]

You've almost certainly run into the change in default behavior for TLS verification introduced in Erlang/OTP 26. See the 3.13 release notes section TLS Defaults https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.13.0

[Sravani Cheruvu]

But as per the image of the conf file that I have shared earlier , we have manually disabled the following parameters in conf file

auth_ldap.ssl_options.verify = verify_none

auth_ldap.ssl_options.fail_if_no_peer_cert =  false  

ssl_options.verify = verify_none 

ssl_options.fail_if_no_peer_cert =  false

Even then , we are not able to connect to Rabbit MQ server via Load balancer

Do we need to disable these parameters anywhere else in the server configuration files ?

--
You received this message because you are subscribed to the Google Groups "rabbitmq-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rabbitmq-user...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/rabbitmq-users/8033588f-1521-4bfb-ac55-37fa0a90d82fn%40googlegroups.com.