如何配置RabbitMQ集群以启用SSL加密通信？

我在两台服务器（rabbitmq@nodes1和rabbitmq@nodes2）上部署了RabbitMQ，已完成管理界面SSL连接配置和AMQP连接SSL加密，且已组建集群，现在需要让集群通信也通过SSL加密。以下是当前监听端口、配置文件内容，以及期望实现的监听端口，需要修改哪些配置项？

当前监听端口 #

Listening ports
Protocol    Node    Bound to    Port
amqp/ssl    rabbit@nodes1   ::  5671
amqp/ssl    rabbit@nodes2   ::  5671
clustering  rabbit@nodes1   ::  25672
clustering  rabbit@nodes2   ::  25672
https   rabbit@nodes1   ::  15671
https   rabbit@nodes2   ::  15671

当前rabbitmq.config配置 #

loopback_users = none

listeners.tcp = none

management.ssl.port       = 15671
management.ssl.cacertfile = /etc/pki/tls/RMQ-CA-certificata.pem
management.ssl.certfile   = /etc/pki/tls/RMQ-server-cert.pem
management.ssl.keyfile    = /etc/pki/tls/RMQ-serverpemkeyfile.pem

management.ssl.versions.1 = tlsv1.3


listeners.ssl.default = 5671
ssl_options.cacertfile = /etc/pki/tls/RMQ-CA-certificata.pem
ssl_options.certfile = /etc/pki/tls/RMQ-server-cert.pem
ssl_options.keyfile = /etc/pki/tls/RMQ-serverpemkeyfile.pem
ssl_options.verify = verify_peer
ssl_options.fail_if_no_peer_cert = true

management.ssl.ciphers.1 = ECDHE-ECDSA-AES256-GCM-SHA384

期望实现的监听端口 #

Listening ports
Protocol    Node    Bound to    Port
amqp/ssl    rabbit@nodes1   ::  5671
amqp/ssl    rabbit@nodes2   ::  5671
clustering/ssl  rabbit@nodes1   ::  25671
clustering/ssl  rabbit@nodes2   ::  25671
https   rabbit@nodes1   ::  15671
https   rabbit@nodes2   ::  15671

要实现集群通信SSL加密，需要对rabbitmq.config做以下修改：

1. 替换TCP集群端口为SSL集群端口 #

• 禁用默认的TCP集群监听端口，添加：

  cluster.tcp.port = none
  

• 配置SSL集群监听端口（对应期望的25671），添加：

  cluster.ssl.port = 25671
  

2. 配置集群通信的SSL认证参数 #

复用已有的CA证书、服务器证书和密钥（如果不需要单独的集群证书），添加以下配置项：

cluster.ssl.cacertfile = /etc/pki/tls/RMQ-CA-certificata.pem
cluster.ssl.certfile = /etc/pki/tls/RMQ-server-cert.pem
cluster.ssl.keyfile = /etc/pki/tls/RMQ-serverpemkeyfile.pem
cluster.ssl.verify = verify_peer
cluster.ssl.fail_if_no_peer_cert = true
cluster.ssl.versions.1 = tlsv1.3

3. 修改后的完整配置示例 #

loopback_users = none

listeners.tcp = none
cluster.tcp.port = none

management.ssl.port       = 15671
management.ssl.cacertfile = /etc/pki/tls/RMQ-CA-certificata.pem
management.ssl.certfile   = /etc/pki/tls/RMQ-server-cert.pem
management.ssl.keyfile    = /etc/pki/tls/RMQ-serverpemkeyfile.pem
management.ssl.versions.1 = tlsv1.3
management.ssl.ciphers.1 = ECDHE-ECDSA-AES256-GCM-SHA384

listeners.ssl.default = 5671
ssl_options.cacertfile = /etc/pki/tls/RMQ-CA-certificata.pem
ssl_options.certfile = /etc/pki/tls/RMQ-server-cert.pem
ssl_options.keyfile = /etc/pki/tls/RMQ-serverpemkeyfile.pem
ssl_options.verify = verify_peer
ssl_options.fail_if_no_peer_cert = true

cluster.ssl.port = 25671
cluster.ssl.cacertfile = /etc/pki/tls/RMQ-CA-certificata.pem
cluster.ssl.certfile = /etc/pki/tls/RMQ-server-cert.pem
cluster.ssl.keyfile = /etc/pki/tls/RMQ-serverpemkeyfile.pem
cluster.ssl.verify = verify_peer
cluster.ssl.fail_if_no_peer_cert = true
cluster.ssl.versions.1 = tlsv1.3

注意事项 #

• 两台RabbitMQ节点的配置必须完全一致
• 确保证书文件在两台节点上的路径正确且权限可读
• 修改配置后需要重启两台节点的RabbitMQ服务
• 重启后通过rabbitmq-diagnostics listeners命令检查监听端口是否已切换为clustering/ssl 25671

内容的提问来源于stack exchange，提问作者Savaş Enes ERATEŞLİ