Firewall issue looks to be resolved, but connection is resetting/failing. I ran wireshark on the target host and saw connection attempts which then get reset. On the shovel client I'm getting this:
2019-09-12 11:25:46.166 [error] <0.1040.0> Shovel 'my_first_shovel' failed to connect (URI: amqps://target.server:5671): closed
2019-09-12 11:25:46.166 [error] <0.1040.0> Shovel 'my_first_shovel' has no more URIs to try for connection and will terminate
2019-09-12 11:25:46.166 [info] <0.1040.0> terminating static worker with {failed_to_connect_using_provided_uris,[{rabbit_amqp091_shovel,make_conn_and_chan,2,[{file,"src/rabbit_amqp091_shovel.erl"},{line,324}]},{rabbit_amqp091_shovel,connect_source,1,[{file,"src/rabbit_amqp091_shovel.erl"},{line,78}]},{rabbit_shovel_worker,handle_cast,2,[{file,"src/rabbit_shovel_worker.erl"},{line,64}]},{gen_server2,handle_msg,2,[{file,"src/gen_server2.erl"},{line,1050}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,249}]}]}
2019-09-12 11:25:46.166 [error] <0.1040.0> ** Generic server <0.1040.0> terminating
** Last message in was {'$gen_cast',init}
** When Server state == {state,undefined,undefined,undefined,undefined,my_first_shovel,static,#{ack_mode => on_confirm,dest => #{add_forward_headers => false,add_timestamp_header => false,fields_fun => #Fun<rabbit_amqp091_shovel.17.14964843>,module => rabbit_amqp091_shovel,props_fun => #Fun<rabbit_amqp091_shovel.17.14964843>,resource_decl => #Fun<rabbit_amqp091_shovel.22.14964843>,uris => ["amqps://administrator:Password1@localhost"]},name => my_first_shovel,reconnect_delay => 5,shovel_type => static,source => #{delete_after => never,module => rabbit_amqp091_shovel,prefetch_count => 10,queue => <<"Store.1.3470">>,resource_decl => #Fun<rabbit_amqp091_shovel.22.14964843>,uris => ["amqps://
target.server
:5671?cacertfile=C:\\RabbitMQ\\domain-ca.crt&certfile=C:\\RabbitMQ\\client.crt&keyfile=C:\\RabbitMQ\\client.unc.key&verify=verify_peer&server_name_indication=
target.server
"]}},undefined,undefined,undefined,undefined,undefined}
** Reason for termination ==
** {failed_to_connect_using_provided_uris,[{rabbit_amqp091_shovel,make_conn_and_chan,2,[{file,"src/rabbit_amqp091_shovel.erl"},{line,324}]},{rabbit_amqp091_shovel,connect_source,1,[{file,"src/rabbit_amqp091_shovel.erl"},{line,78}]},{rabbit_shovel_worker,handle_cast,2,[{file,"src/rabbit_shovel_worker.erl"},{line,64}]},{gen_server2,handle_msg,2,[{file,"src/gen_server2.erl"},{line,1050}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,249}]}]}
2019-09-12 11:25:46.166 [error] <0.1040.0> CRASH REPORT Process <0.1040.0> with 0 neighbours exited with reason: failed_to_connect_using_provided_uris in rabbit_amqp091_shovel:make_conn_and_chan/2 line 324 in gen_server2:terminate/3 line 1166
2019-09-12 11:25:46.166 [error] <0.1036.0> Supervisor {<0.1036.0>,mirrored_supervisor_sups} had child my_first_shovel started with rabbit_shovel_worker:start_link(static, my_first_shovel, #{ack_mode => on_confirm,dest => #{add_forward_headers => false,add_timestamp_header => false,fields_fun => ...,...},...}) at <0.1040.0> exit with reason failed_to_connect_using_provided_uris in rabbit_amqp091_shovel:make_conn_and_chan/2 line 324 in context child_terminated
**************************************************************************************************************************
Here is the shovel connection config:
{rabbitmq_shovel,
[{shovels,
[
{my_first_shovel,
[
{sources,
[{brokers, ["amqps://target.server:5671?cacertfile=C:\\RabbitMQ\\domain-ca.crt&certfile=C:\\RabbitMQ\\client.crt&keyfile=C:\\RabbitMQ\\client.key&verify=verify_peer&server_name_indication=
target.server
"]},
{declarations, []}]
},
{destinations,
[{broker, "amqps://admin:pwd@localhost"},
{declarations, []}]
},
{queue, <<"Store.1.3470">>},
{prefetch_count, 10},
{ack_mode, on_confirm},
{publish_fields, [{exchange,<<"Ncr.Retail.Store">>}]},
{publish_properties, [{delivery_mode, 2}]},
{reconnect_delay, 5}
**************************************************************************************************************************
The certs were converted with OpenSSL, just without the pem extension but are in proper form. I concatenated the domain certs as the hosts are in different domains with different CA's. The key was saved without a password, so no password needed in the connection.