RabbitMQ开启SSL与SpringBoot连接测试的配置方法

更新时间:2023-04-04 11:08:50 阅读：评论：0

楔子

近期公司程序被安全扫描出 远程主机允许明文身份验证 中风险漏洞，查了下修复方案，rabbitmq官方提供了ssl连接方式，而且 springboot amqp 也支持 ssl 连接。以下将配置rabbitmq开启ssl 并使用 springboot demo 测试连接。

ps : 写文章时此配置还未安全扫描复测，如果测试通过，本人将更新此文章状态为验证通过。

配置 rabbitmq 开启 ssl

本文基于 centos 7 + git + openssl + yum 安装的 rabbitmq，需要读者提交安装好。其他方式也可变通参考本文。

生成证书

#克隆生成证书的仓库到当前目录git clone --depth 1 https://github.com/berico-technologies/cmf-amqp-configuration.gitcd cmf-amqp-configuration/ssl#生成ca证书，“myrabbitmqca”为自定义名称，名称任意。在当前目录下生成ca目录sh tup_ca.sh myrabbitmqca#生成服务端证书，第一个参数是服务端证书前缀，第二个参数是密码。密码任意，在当前目录下生成rver目录sh make_rver_cert.sh rabbitmq-rver 123456#生成客户端证书，第一个参数是客户端证书前缀，第二个参数是密码。密码任意，在当前目录下生成client目录sh create_client_cert.sh rabbitmq-client 654321

配置 rabbitmq 服日式餐厅设计务端的证书如下：

ca/cacert.pem #ca证书rver/rabbitmq-rver.cert.pem #服务端公钥rver/rabbitmq-rver.key.pem  #服务端私钥

使用 rabbitmq 服务端公钥证书生成 jks 证书

# -alias后为别称，-file后是服务端公钥位置，-keystore后是输出jsk证书位置，此处相对路径keytool -import -alias rabbitmq-rver \  -file rver/rabbitmq-rver.cert.pem \  -keystore rabbitmqtruststore -storepass changeit#输入y回车

配置 rabbitmq 客户端的证书如下：

client/rabbitmq-client.keycert.p12 #pkcs12证书，包含客户端所需公私钥及中间证书rabbitmqtruststore #服务端jks格式公钥

默认 rabbitmq 配置目录在 /etc/rabbitmq，我们创建个证书目录存放服务端证书

mkdir -p /etc/rabbitmq/ssl#复制服务端必要证书cp ca/cacert.pem \rver/rabbitmq-rver.cert.pem \rver/rabbitmq-rver.key.pem /etc/rabbitmq/ssl/

修改 rabbitmq 配置文件

修改 rabbitmq 配置文件 /etc/rabbitmq/rabbitmq.config，此文件默认不存在，需要手动创建

[{rabbit, [
{ssl_listeners, [5671]},
{ssl_options, [
{cacertfile, “/etc/rabbitmq/ssl/cacert.pem”},
{certfile, “/etc/rabbitmq/ssl/rabbitmq-rver.cert.pem”},
{keyfile, “/etc/rabbitmq/ssl/rabbitmq-rver.key.pem”},
{verify, verify_peer},
{fail_if_no_peer_cert, true},
{ciphers, [
“ecdhe-ecdsa-aes256-gcm-sha384″,”ecdhe-rsa-aes256-gcm-sha384”,
“ecdhe-ecdsa-ae理财攻略s256-sha384″,”ecdhe-rsa-aes256-sha384”,
“ecdhe-ecdsa-des-cbc3-sha”,”ecdh-ecdsa-aes256-gcm-sha384″,
“ecdh-rsa-aes256-gcm-sha384″,”ecdh-ecdsa-aes256-sha384”,
“ecdh-rsa-aes256-sha384″,”dhe-dss-aes256-gcm-sha384”,
“dhe-dss-aes256-sha256″,”aes256-gcm-sha384”,
“aes256-sha256″,”ecdhe-ecdsa-aes128-gcm-sha256”,
“ecdhe-rsa-aes128-gcm-sha256″,”ecdhe-ecdsa-aes128-sha256”,
“ecdhe-rsa-aes128-sha256″,”ecdh-ecdsa-aes128-gcm-sha256”,
“ecdh-rsa-aes128-gcm-sha256″,”ecdh-ecdsa-aes128-sha256”,
“ecdh-rsa-aes128-sha256″,”dhe-dss-aes128-gcm-sha256”,
“dhe-dss-aes128-sha256″,”aes128-gcm-sha256”,
“aes128-sha256″,”ecdhe-ecdsa-aes256-sha”,
“ecdhe-rsa-aes256-sha”,”dhe-dss-aes256-sha”,
“ecdh-ecdsa-aes256-sha”,”ecdh-rsa-aes256-sha”,
“aes256-sha”,”ecdhe-ecdsa-aes128-sha”,
“ecdhe-rsa-aes128-sha”,”dhe-dss-aes128-sha”,
“ecdh-ecdsa-aes128-sha”,”ecdh-rsa-aes128-sha”,”aes128-sha”
]}
]}
]}].

主要配置项说明：

ssl_listeners 指定 ssl协议的端口号，官方文档 5671ssl_options ssl 认证配置项cacertfile ca 证书位置certfile 公钥证书位置keyfile 密钥证书位置verifyveri制片人韩剧fy_peer 客户端与服务端互相发送证书verify_none 禁用证书交换与校验fail_if_no_peer_certtrue 不接受没证书的客户端连接fal 接受没证书的客户端连接ciphers 加密器（这个翻译不知道算不算对？）

重启 rabbitmq

#关闭rabbitmqctl stop#启动rabbitmq-rver -detached

验证开启 ssl 是否成功

使用 rabbitmq 自带的诊断工具查看端口监听状态及使用协议

#查看监听rabbitmq-diagnostics listeners#查看支持的tls版本rabbitmq-diagnostics --silent tls_versions

使用 openssl cli 工具验证证书是否有效

cd 生成证书的ssl目录#使用客户端证书+ca证书连接rabbitmq验证。本处mq与生成证书是同一主机，其他情况请自行考虑。openssl s_client -connect localhost:5671 \  -cert client/rabbitmq-client.cert.pem \  -key client/rabbitmq-client.key.pem \  -cafile ca/cacert.pem

除了命令行查看外，还可以通过管理界面查看，不过只能确定开启了 ssl 监听，无法确认证书是否通过验证。

编写 springboot 代码连接测试

代码结构

只是使用 start.spring.io 生成的 maven 工程，依赖了 web 和 amqp

代码及配置

pom.xml

<?xml version="1.0" encoding="utf-8"?><project xmlns="http://maven.apache.org/pom/4.0.0" xmlns:xsi="http://www.w3.org/2001/xmlschema-instance"xsi:schemalocation="http://maven.apache.org/pom/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"><modelversion>4.0.0</modelversion><parent><groupid>org.springframework.boot</groupid><artifactid>spring-boot-starter-parent</artifactid><version>2.5.8</version><relativepath/> <!-- lookup parent from repository --></parent><groupid>com.example</groupid><artifactid>demo</artifactid><version>0.0.1-snapshot</version><name>demo</name><description>demo project for spring boot</description><properties><java.version>1.8</java.version></properties><dependencies><dependency><groupid>org.springframework.boot</groupid><artifactid>spring-boot-starter-amqp</artifactid></dependency><dependency><groupid>org.springframework.boot</groupid><artifactid>spring-boot-starter-web</artifactid></dependency><dependency><groupid>org.springframework.boot</groupid><artifactid>spring-boot-starter-test</artifactid><scope>test</scope></dependency><dependency><groupid>org.springframework.amqp</groupid><artifactid>spring-rabbit-test</artifactid><scope>test</scope></dependency></dependencies><build><plugins><plugin><groupid>org.springframework.boot</groupid><artifactid>spring-boot-maven-plugin</artifactid></plugin></plugins></build></project>

启动类 demoapplication.java

package com.hellxz.rabbitmq.ssl;import org.springframework.boot.springapplication;import org.springframework.boot.autoconfigure.springbootapplication;@springbootapplicationpublic class demoapplication {    public static void main(string[] args) {        spricome过去式ngapplication.run(demoapplication.class, args);    }}

rabbitmq客户端配置类 rabbitfanoutexchangeconfig.java

package com.hellxz.rabbitmq.ssl;import org.springframework.amqp.core.binding;import org.springframework.amqp.core.bindingbuilder;import org.springframework.amqp.core.fanoutexchange;import org.springframework.amqp.core.queue;import org.springframework.beans.factory.annotation.qualifier;import org.springframework.context.annotation.bean;import org.springframework.context.annotation.configuration;@configurationpublic class rabbitfanoutexchangeconfig {    public static final string fanout_exchange = "fanout.exchange";    public static final string fanout_queue1 = "fanout.queue1";    @bean(name = fanout_exchange)    public fanoutexchange fanoutexchange() {        return new fanoutexchange(fanout_exchange, true, fal);    }    @bean(name = fanout_queue1)    public queue fanoutqueue1() {        return new queue(fanout_queue1, true, fal, fal);    }        @bean    public binding bindingsimplequeue1(@qualifier(fanout_queue1) queue fanoutqueue1,                                       @qualifier(fanout_exchange) fanoutexchange fanoutexchange) {        return bindingbuilder.bind(fanoutqueue1).to(fanoutexchange);    }}

发消息测试类 testcontroller.java

package com.hellxz.rabbitmq.ssl;import org.springframework.amqp.core.message;import org.springframework.beans.factory.annotation.autowired;import org.springframework.web.bind.annotation.getmapping;import org.springframework.web.bind.annotation.restcontroller;@restcontrollerpublic class testcontroller {    @autowired    rabbitmqnderrvice rabbitmqnderrvice;        @getmapping("/test")    public void ndmsg() {        message msg = new message("hello world".getbytes());        try {            rabbitmqnderrvice.nd(rabbitfanoutexchangeconfig.fanout_exchange,                    rabbitfanoutexchangeconfig.fanout_queue1, msg);        } catch (exception e) {            e.printstacktrace();        }    }}

发消息服务 rabbitmqnderrvice.java

package com.hellxz.rabbitmq.ssl;import java.util.uuid;import org.springframework.amqp.core.message;import org.springframework.amqp.rabbit.connection.correlationdata;import org.springframework.amqp.rabbit.core.rabbittemplate;import org.springframework.beans.factory.annotation.autowired;import org.s主题学习pringframework.stereotype.component;@componentpublic class rabbitmqnderrvice {    @autowired    private rabbittemplate rabbittemplate;    public void nd(string exchange, string routingkey, message message) {        correlationdata correlationid = new correlationdata(uuid.randomuuid().tostring());        system.out.println("start nd msg : " + message);        rabbittemplate.convertandnd(exchange, routingkey, message, correlationid);        system.out.println("end nd msg : " + message);    }}

消息接收者 rabbitmqreciver.java

package com.hellxz.rabbitmq.ssl;import org.springframework.amqp.rabbit.annotation.rabbitlistener;import org.springframework.stereotype.component;@componentclass rabbitmqreciver {    @rabbitlistener(queues = rabbitfanoutexchangeconfig.fanout_queue1)    public void recivelogall(string msg) throws exception {        system.out.println("received msg:" + msg);    }}

配置文件 application.properties

rver.port=8085#基础配置请根据实际配置spring.rabbitmq.host=192.168.56.104#ssl协议端口spring.rabbitmq.port=5671spring.rabbitmq.urname=adminspring.rabbitmq.password=123456spring.rabbitmq.virtual-host=/#启用rabbitmq客户端ssl连接spring.rabbitmq.ssl.enabled=true#客户端pkcs12证书及密码spring.rabbitmq.ssl.key-store=classpath:ssl/rabbitmq-client.keycert.p12spring.rabbitmq.ssl.key-store-password=654321#公钥证书及类型spring.rabbitmq.ssl.trust-store=classpath:ssl/rabbitmqtruststorespring.rabbitmq.ssl.trust-store-type=jks#不校验主机名，默认开启会导致连接失败spring.rabbitmq.ssl.verify-hostname=fal

src/main/resources 下创建 ssl 目录，将客户端证书和服务端jks公钥复制到 ssl 目录中。

执行代码验证

运行 demoapplication.java，查看控制台是否有报错：

如图，提示创建连接成功，说明已经连接成功了。

我们再调用 testcontroller.java 中定义的 /test 接口

消息发送与消费成功。