Pika using self-signed SSL certificates

[Jules Ex]

Hi,

I'm pretty new to SSL & Pika, so sorry if this is obvious. I've read the documentation but I'm having trouble using self signed SSL. I've done some wider reading / reseach and the suggestions on StackOverflow suggest adding my CA cert to the local OS of the machine, but I'm not going to have OS level access to the machine where this will run, so need a solution that works within Python. The Python SSL documentation I read suggested that your can reference a CA cert in your code to override the OS certificate store, which is what I am doing, so I still get an error saying that the SSL verification failed because of a self signed certificate.

Is there a walk through or example code anyone could point me to please for using self signed certificates with Pika? I feel I don't know enough about SSL to be able to get this to work without a little help.

I've tried the generic SSL Pika code, but I assume that is expecting a "real" SSL cert and not a self signed on as I get the following error "ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1108)"

I have my RabbitMQ project working without SSL on my local network, but I want to be able to deploy it on a VM at a hosting company and connect over the Internet to it, so really want SSL working. It's only me that will be connecting to it, and there's nothing important on there, I just don't want people messing with it.

Any assistance would very much be apprecaited. Thank you!

[Luke Bakken]

Hello,

You need to pass a ssl context to Pika: https://docs.python.org/3/library/ssl.html#ssl-contexts

Grep the Pika source code for SSLContext.

Another option is to use an amqps:// URI in the same manner as the test suite, though it's not as friendly on the eyes:

https://github.com/pika/pika/blob/main/tests/base/async_test_base.py#L116-L124

Basically, your code is going to create an ssl context this way:

https://github.com/pika/pika/blob/main/pika/connection.py#L894-L913

Unless you're using client certificates, you really only need to add the path to the CA cert via the "cafile" argument to load_verify_locations.

If you need further assistance, start a discussion here:

https://github.com/pika/pika/discussions

Link to a git repository containing your code that I can fork and clone.

Thanks,

Luke

[Jules Ex]

Thank you for the detailed reply Luke, I really appreciate it. I will give this a go.