GCP部署RabbitMQ后Mosquitto MQTT over TLS协议错误求助

部署环境 #

按照RabbitMQ TLS支持文档，使用以下Terraform脚本在GCP部署RabbitMQ服务器：

provider "google" {
  project = var.project_id
  region  = var.region
}

resource "google_compute_network" "vpc_network" {
  name = "rabbitmq-ssl-network"
}

resource "google_compute_address" "static_ip" {
  name         = "rabbitmq--ssl-static-ip"
  address_type = "EXTERNAL"
}

resource "google_compute_instance" "rabbitmq_instance" {
  name         = "rabbitmq-vm-ssl"
  machine_type = "e2-micro"
  zone         = "europe-west1-d"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  network_interface {
    network = google_compute_network.vpc_network.name
    access_config {
      nat_ip = google_compute_address.static_ip.address
    }
  }

  metadata_startup_script = <<-EOT
    #! /bin/bash
    sudo su <<EOF
    apt-get update
    apt-get install -y docker.io
    apt-get install -y git
    apt-get install -y make

    # Clone tls-gen repository
    git clone https://github.com/rabbitmq/tls-gen tls-gen
    cd tls-gen/basic
    make PASSWORD=bunnies
    make verify
    make info
    ls -l ./result

    # Copy the contents of the result directory to /etc/rabbitmq/ssl
    mkdir -p /etc/rabbitmq/ssl
    cp -r ./result/* /etc/rabbitmq/ssl

    # Give permissions so that RabbitMQ can read the files
    chmod 755 /etc/rabbitmq/ssl/*

    # Create RabbitMQ configuration file
    mkdir -p /etc/rabbitmq/conf
    cat <<EOC | tee /etc/rabbitmq/conf/rabbitmq.conf
listeners.ssl.default = 5671
mqtt.listeners.ssl.default = 8883
mqtt.listeners.tcp.default = 1883
mqtt.allow_anonymous = true
mqtt.default_user     = guest
mqtt.default_pass     = guest
mqtt.vhost            = /
ssl_options.cacertfile = /etc/rabbitmq/ssl/ca_certificate.pem
ssl_options.certfile = /etc/rabbitmq/ssl/server_rabbitmq-vm-ssl_certificate.pem
ssl_options.keyfile = /etc/rabbitmq/ssl/server_rabbitmq-vm-ssl_key.pem
ssl_options.verify = verify_peer
ssl_options.fail_if_no_peer_cert = false
EOC

    # Start RabbitMQ container with SSL
    echo "Starting RabbitMQ container with SSL"
    docker run -d --name rabbitmq_mqtt -p 5672:5672 -p 15672:15672 -p 8883:8883 -p 1883:1883 -p 8443:8443 \
      -v /etc/rabbitmq/ssl:/etc/rabbitmq/ssl \
      -v /etc/rabbitmq/conf/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf \
      rabbitmq:3-management
    docker exec rabbitmq_mqtt rabbitmq-plugins enable --offline rabbitmq_mqtt
    docker restart rabbitmq_mqtt
    EOF
  EOT
}

resource "google_compute_firewall" "allow_rabbitmq" {
  name    = "allow-rabbitmq-sll-server"
  network = google_compute_network.vpc_network.name

  allow {
    protocol = "tcp"
    ports    = ["5672", "15672", "8883", "1883", "8443"]
  }

  source_ranges = ["0.0.0.0/0"]
}

resource "google_compute_firewall" "allow_ssh" {
  name    = "allow-ssh-ssl-server"
  network = google_compute_network.vpc_network.name

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source_ranges = ["0.0.0.0/0"]
}

output "rabbitmq_ip" {
  value = google_compute_address.static_ip.address
}

生成的证书文件 #

部署完成后，服务器上/etc/rabbitmq/ssl目录下的证书文件如下：

root@rabbitmq-vm-ssl:/etc/rabbitmq/ssl# ls
ca_certificate.pem          client_rabbitmq-vm-ssl_certificate.pem  server_rabbitmq-vm-ssl_certificate.pem
ca_key.pem                  client_rabbitmq-vm-ssl_key.pem          server_rabbitmq-vm-ssl_key.pem
client_rabbitmq-vm-ssl.p12  server_rabbitmq-vm-ssl.p12

连接错误现象 #

• 使用Mosquitto客户端通过TLS端口（8883）订阅时报错：

  mosquitto_sub -h <public-ip-address> -t testssl/topic --cafile ca_certificate.pem
  Error: Protocol error
  

• 使用TCP端口（1883，无TLS）连接时通信正常。

已完成的排查步骤 #

1. 监听器配置验证：确认RabbitMQ已正确开启MQTT TLS监听器

   # rabbitmq-diagnostics listeners
   Asking node rabbit@<random-string> to report its protocol listeners ...
   Interface: [::], port: 15672, protocol: http, purpose: HTTP API
   Interface: [::], port: 1883, protocol: mqtt, purpose: MQTT
   Interface: [::], port: 8883, protocol: mqtt/ssl, purpose: MQTT over TLS
   Interface: [::], port: 15692, protocol: http/prometheus, purpose: Prometheus exporter API over HTTP
   Interface: [::], port: 25672, protocol: clustering, purpose: inter-node and CLI tool communication
   Interface: [::], port: 5672, protocol: amqp, purpose: AMQP 0-9-1 and AMQP 1.0
   Interface: [::], port: 5671, protocol: amqp/ssl, purpose: AMQP 0-9-1 and AMQP 1.0 over TLS
   

2. TLS版本支持验证：确认服务器支持多种TLS版本

   # rabbitmq-diagnostics --silent tls_versions
   tlsv1.3tlsv1.2tlsv1.1tlsv1
   

额外连接测试的错误 #

在服务器端启动openssl测试服务：

root@rabbitmq-vm-ssl:/etc/rabbitmq/ssl# openssl s_server -accept 8443 -cert server_rabbitmq-vm-ssl_certificate.pem -key server_rabbitmq-vm-ssl_key.pem -CAfile ca_certificate.pem
Enter pass phrase for server_rabbitmq-vm-ssl_key.pem:
Using default temp DH parameters
ACCEPT

本地客户端连接时出现拒绝错误：

openssl s_client -connect <static-ip>:8443 -cert client_certificate.pem  -key client_key.pem -CAfile ca_certificate.pem -verify 8 -verify_hostname rabbitmq-vm-ssl
verify depth is 8
Enter pass phrase for client_key.pem:
000C8AF401000000:error:8000003D:system library:BIO_connect:Connection refused:crypto/bio/bio_sock2.c:178:calling connect()
000C8AF401000000:error:10000067:BIO routines:BIO_connect:connect error:crypto/bio/bio_sock2.c:180:
connect:errno=61

怀疑证书配置存在遗漏，证书通过tls-gen工具生成时未指定IP或主机名，现寻求问题排查帮助。

内容的提问来源于stack exchange，提问作者Igor L.