rabbitmq bad_header,<<16,36,0,6,77,81,73,115>>

[Matej Mašat]

Hi there,

I'm having a problem with setup rabbitmq 3.8.8 with TLS... I have installed it via win installer. For generating certificates I’m using tls-gen, I'm also using openssl 1.1.1f and erlang ver 22

Without TLS I'm able to subscribe with mqtt.fx and mqtt-spy and everything works fine, once I would like to add TLS support I'm getting bad_header exception within server log.

2020-09-11 13:00:40.847 [info] <0.1332.0> accepting AMQP connection <0.1332.0> ([xxxx::xxxx:xxxx:xxxx:xxxx]:54310 -> [xxxx::xxxx:xxxx:xxxx:xxxx]:8883)
2020-09-11 13:00:40.848 [error] <0.1332.0> closing AMQP connection <0.1332.0> ([xxxx::xxxx:xxxx:xxxx:xxxx]:54310 -> [xxxx::xxxx:xxxx:xxxx:xxxx]:8883):
{bad_header,<<16,26,0,4,77,81,84,84>>}

 

I'm able to setup server via cmd:
openssl s_server -accept 8443 -cert server_certificate.pem -key server_key.pem -CAfile ca_certificate.pem

and I'm also able to connect with client with cmd:
openssl s_client -connect myHostname:8443 -cert client_certificate.pem -key client_key.pem -CAfile ca_certificate.pem -verify 8 -verify_hostname myHostname

 

And I’m able to use it as telnet – whatever I type in is visible at server/client side. In case above TLS v1.3 is used… If I specify to use version 1.2 then I sometimes get error e.g. client side:

---

Test content

KEYUPDATE

34359836736:error:1420310A:SSL routines:SSL_key_update:wrong ssl version:ssl/ssl_lib.c:2099:

 

Those are plugins which I have enabled… Did I miss something here?

[E ] rabbitmq_amqp1_0                      3.8.8
[E ] rabbitmq_auth_mechanism_ssl         3.8.8
[E ] rabbitmq_management                       3.8.8
[e ] rabbitmq_management_agent           3.8.8
[E ] rabbitmq_mqtt                             3.8.8
[e ] rabbitmq_web_dispatch                3.8.8
[E] rabbitmq_peer_discovery_consul      3.8.8
[e] rabbitmq_peer_discovery_common  3.8.8

I’m also attaching rabbitmq log file, config file and screenshot from wireshark – when I was establishing connection with mqtt.fx… Any suggestions?

Thank you for your support!

Best regards,
Matej

[Luke Bakken]

Hello,

You have port 8883 configured as an AMQP TLS listener. If you connect to it using an MQTT client, you will see this error.

You need to enable TLS for the MQTT port - https://www.rabbitmq.com/mqtt.html#tls

Thanks,

Luke

[Matej Mašat]

Hi,

Luke thank you for response...

Ok, I have updated config file as is attachment... If set it to 1883 and it says that port is already in use… I quickly check with netstat and no-one is using this port. Therefore I check also other posts and find something related that during server startup it could happen that some other node starts using that port. Afterall I try to stop node and node was never stopped – don’t know why…

After all I decided to start listening on 1884 and also client connects to 1884 but I’m sill getting such response. Is there anything else or some other configuration file that I need to change?

Thank you for your support!

Best regards,
Matej

[Luke Bakken]

Hi Matej,

Your configuration is still setting the AMQP port to 1883. AMQP and MQTT use different ports.

Please do the following:

• Log in as the administrative user that installed RabbitMQ
• Stop the RabbitMQ Windows service
• Move all configuration files out of %AppData%\RabbitMQ
• Save the two configuration files attached to this response to that directory
• Re-start the RabbitMQ Windows service
• Re-try your test

If your test fails, do the following:

• Attach your full RabbitMQ log file to your response
• Run the rabbitmqctl.bat environment command. Save the output to a file and attach it to your response.

Thanks,

Luke

[Matej Mašat]

Hi Luke,

sorry for my late response...

Once I changed listeners.tcp = 5672 to listeners.tcp.default = 5672, it works perfectly. 

Actually, I didn't know that I need to create rabbitmq.conf manually, since advanced.config was already in %appData%Roaming%RabbitMQ – therefore I want to put everything to advanced.config. 

Thank you once again for your support! 

Best regards,

Matej  

[Luke Bakken]

Hello,

Thank you for following up with the mailing list.

Luke