Skip to content

Instantly share code, notes, and snippets.

@michaelklishin

michaelklishin/rabbitmq.config

Last active August 29, 2015 14:07
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save michaelklishin/3f47bae850bdd9f1a79a to your computer and use it in GitHub Desktop.
Save michaelklishin/3f47bae850bdd9f1a79a to your computer and use it in GitHub Desktop.
Download ZIP
Raw
rabbitmq.config
%% Disable SSLv3.0 support
[
{ssl, [{versions, ['tlsv1.2', 'tlsv1.1', tlsv1]}]},
{rabbit, [
{ssl_listeners, [5671]},
{ssl_options, [{cacertfile,"/path/to/ca_certificate.pem"},
{certfile, "/path/to/server_certificate.pem"},
{keyfile, "/path/to/server_key.pem"},
{versions, ['tlsv1.2', 'tlsv1.1', tlsv1]}
]}
]}
].
%% to verify, use openssl s_client:
%% openssl s_client -connect 127.0.0.1:5671 -ssl3
%%
%% to test with TLSv1:
%% openssl s_client -connect 127.0.0.1:5671 -tls1
%%
%% and look for the following in the output:
%% SSL-Session:
%% Protocol : TLSv1
@michaelklishin
Copy link
Author

Note that due to OTP-10905, to disable SSLv3 you need Erlang/OTP R16B01 or later. In other versions, the list of protocol versions is ignored by ssl:listen/2.

@simonmacmullen
Copy link

Just to make it clear on this page: only needed for RabbitMQ 3.3.5 and earlier; 3.4.0 and later does this for you.

@brc859844
Copy link

Simon, Michael, just in case someone specifies {versions, [...]} for the management plugin (or other web contexts), you might want to add something like the following to rabbit_mgmt_external_stats.erl to stop it barfing with "badarg":

format_mochiweb_option(versions, V) ->
    list_to_binary(rabbit_misc:format("~w", [V]));

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment