RabbitMQ Docker镜像TLS握手失败问题排查求助

问题概述 #

在虚拟机中运行rabbitmq:3.10.7-management镜像配置AMQPS，使用链式TLS证书，按RabbitMQ官方TLS指南配置后容器启动无报错，但TLS连接立即失败，不同环境下均提示connection reset by peer，TLS握手完全失败；启用TCP后非TLS客户端可正常连接。

Docker-Compose RabbitMQ配置 #

rabbitmq:
  restart: unless-stopped
  hostname: rabbitmq
  image: rabbitmq:3.10.7-management
  networks:
    - traefik
  ports:
    - "5672:5672"
    - "5671:5671"
  logging:
    options:
      max-size: "10m"
      max-file: "3"
  volumes: 
    - ./rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf
    - ./certs:/certs
    - /data/rabbitmq_data:/var/lib/rabbitmq
  labels:
    - "traefik.enable=true"
    - "traefik.http.routers.rabbitmq-secure.priority=150"
    - "traefik.http.services.rabbitmq-secure.loadbalancer.server.port=15672"
    - "traefik.http.routers.rabbitmq-secure.rule=Host(`<myDomain>`) && PathPrefix(`/`)"
    - "traefik.http.routers.rabbitmq-secure.entrypoints=web-secure"
    - "traefik.http.routers.rabbitmq-secure.tls=true"
    - "traefik.http.routers.rabbitmq-secure.tls.options=myTLSOptions@file"
    - "traefik.http.routers.rabbitmq.rule=Host(`<myDomain>`) && PathPrefix(`/`)"
    - "traefik.http.routers.rabbitmq.entrypoints=web"

证书信息 #

• ca_certificate.pem：包含根证书（CN=T-TeleSec GlobalRoot Class 2, OU=T-Systems Trust Center, O=T-Systems Enterprise Services GmbH, C=DE）及2个链式证书
• server_certificate.pem：通配符证书
• server_key.pem：通配符证书对应的私钥

注：同证书用于管理前端服务无问题，且在Mosquitto MQTTS服务中可正常工作

RabbitMQ配置文件 (rabbitmq.conf) #

log.console.level = debug

listeners.ssl.default = 5671

listeners.tcp = none

ssl_options.cacertfile = /certs/ca_certificate.pem
ssl_options.certfile   = /certs/server_certificate.pem
ssl_options.keyfile    = /certs/server_key.pem
ssl_options.verify     = verify_none
ssl_options.fail_if_no_peer_cert = false

ssl_options.versions.1 = tlsv1.3
ssl_options.versions.2 = tlsv1.2

ssl_options.honor_cipher_order = false
ssl_options.honor_ecc_order    = false
ssl_handshake_timeout = 10000

ssl_options.ciphers.1 = ECDHE-ECDSA-AES256-GCM-SHA384
ssl_options.ciphers.2 = ECDHE-RSA-AES256-GCM-SHA384
ssl_options.ciphers.3 = ECDHE-ECDSA-AES128-GCM-SHA256
ssl_options.ciphers.4 = ECDHE-RSA-AES128-GCM-SHA256
ssl_options.ciphers.5 = ECDHE-ECDSA-CHACHA20-POLY1305
ssl_options.ciphers.6 = ECDHE-RSA-CHACHA20-POLY1305
ssl_options.ciphers.7 = DHE-RSA-AES128-GCM-SHA256
ssl_options.ciphers.8 = DHE-RSA-AES256-GCM-SHA384

已执行的排查操作 #

1. 日志验证：容器日志显示TLS监听器正常启动

   ...
   2022-09-06 14:42:22.024539+00:00 [info] <0.615.0> started TLS (SSL) listener on [::]:5671
   ...
   

2. 监听器检查：

   rabbitmq@rabbitmq:/$ rabbitmq-diagnostics listeners
   Asking node rabbit@rabbitmq to report its protocol listeners ...
   Interface: [::], port: 15672, protocol: http, purpose: HTTP API
   Interface: [::], port: 15692, protocol: http/prometheus, purpose: Prometheus exporter API over HTTP
   Interface: [::], port: 25672, protocol: clustering, purpose: inter-node and CLI tool communication
   Interface: [::], port: 5671, protocol: amqp/ssl, purpose: AMQP 0-9-1 and AMQP 1.0 over TLS
   

3. 证书权限检查：

   rabbitmq@rabbitmq:/certs$ ls -ll
   total 20
   -rw-r--r-- 1 rabbitmq rabbitmq 1366 Sep  6 14:39 ca_certificate.pem
   -rw-r--r-- 1 rabbitmq rabbitmq 6943 Sep  6 14:39 server_certificate.pem
   -rw-r--r-- 1 rabbitmq rabbitmq 3275 Sep  5 13:20 server_key.pem
   

4. Erlang TLS版本支持检查：

   rabbitmq@rabbitmq:/certs$ rabbitmq-diagnostics --silent tls_versions
   tlsv1.3
   tlsv1.2
   tlsv1.1
   tlsv1
   

5. 本地openssl TLS连接测试：握手失败

   rabbitmq@rabbitmq:/certs$ openssl s_client -connect localhost:5671
   CONNECTED(00000003)
   write:errno=104
   ---
   no peer certificate available
   ---
   No client certificate CA names sent
   ---
   SSL handshake has read 0 bytes and written 293 bytes
   Verification: OK
   ---
   New, (NONE), Cipher is (NONE)
   Secure Renegotiation IS NOT supported
   Compression: NONE
   Expansion: NONE
   No ALPN negotiated
   Early data was not sent
   Verify return code: 0 (ok)
   ---
   

当前尝试多种证书配置方式均无效，尝试TLS连接时调试日志无错误，但监听器似乎完全不接受TLS连接请求，寻求排查方向及解决方案。

内容的提问来源于stack exchange，提问作者Sweeman