rabbitmq ssl/tls及pika tls认证连接方法

Dear 丶 2021-12-14 12:25 919阅读 0赞

rabbitmq开启ssl：

# Enable AMQPS
    listeners.ssl.default = 5671
    ssl_options.cacertfile = PIKA_DIR/testdata/certs/ca_certificate.pem
    ssl_options.certfile = PIKA_DIR/testdata/certs/server_certificate.pem
    ssl_options.keyfile = PIKA_DIR/testdata/certs/server_key.pem
    ssl_options.verify = verify_peer
    ssl_options.fail_if_no_peer_cert = true
    
    # Enable HTTPS
    management.listener.port = 15671
    management.listener.ssl = true
    management.listener.ssl_opts.cacertfile = PIKA_DIR/testdata/certs/ca_certificate.pem
    management.listener.ssl_opts.certfile = PIKA_DIR/testdata/certs/server_certificate.pem
    management.listener.ssl_opts.keyfile = PIKA_DIR/testdata/certs/server_key.pem

connection的参数中默认是不直接支持ssl的，需要传递SSLOptions参数

使用ssl方法：

class SSLOptions(object):
        def __init__(self, context, server_hostname=None):
            """
            :param ssl.SSLContext context: SSLContext instance
            :param str|None server_hostname: SSLContext.wrap_socket, used to enable
                SNI
            """

context 为ssl.SSLContext 因此初始化的时候，使用ssl.SSLContext 加载证书，及配置参数

证书加载： `SSLContext.load_cert_chain(certfile, keyfile=None, password=None)`

具体参考 ssl.SSLContext

客户端示例：

import logging
    import pika
    import ssl
    
    logging.basicConfig(level=logging.INFO)
    context = ssl.create_default_context(
        cafile="PIKA_DIR/testdata/certs/ca_certificate.pem")
    context.load_cert_chain("PIKA_DIR/testdata/certs/client_certificate.pem",
                            "PIKA_DIR/testdata/certs/client_key.pem")
    ssl_options = pika.SSLOptions(context, "localhost")
    conn_params = pika.ConnectionParameters(port=5671,
                                            ssl_options=ssl_options)
    
    with pika.BlockingConnection(conn_params) as conn:
        ch = conn.channel()
        ch.queue_declare("foobar")
        ch.basic_publish("", "foobar", "Hello, world!")
        print(ch.basic_get("foobar"))

服务器配置：

%% Note that the {fail_if_no_peer_cert,false} option, states that RabbitMQ should accept 
    clients that don't have a certificate to send to the broker, but through the {verify,verify_peer}
     option, we state that if the client does send a certificate to the broker, the broker must
      be able to establish a chain of trust to it.
    
    [
      {rabbit,
        [
          {ssl_listeners, [{"127.0.0.1", 5671}]},
    
          %% Configuring SSL.
          %% See http://www.rabbitmq.com/ssl.html for full documentation.
          %%
          {ssl_options, [{cacertfile,           "/Users/me/tls-gen/basic/testca/cacert.pem"},
                         {certfile,             "/Users/me/tls-gen/basic/server/cert.pem"},
                         {keyfile,              "/Users/me/tls-gen/basic/server/key.pem"},
                         {verify,               verify_peer},
                         {fail_if_no_peer_cert, false}]}
        ]
      }
    ].

客户端：

import ssl
    import pika
    import logging
    
    logging.basicConfig(level=logging.INFO)
    
    context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
    context.verify_mode = ssl.CERT_REQUIRED
    context.load_verify_locations('/Users/me/tls-gen/basic/testca/cacert.pem')
    
    cp = pika.ConnectionParameters(ssl_options=pika.SSLOptions(context))
    
    conn = pika.BlockingConnection(cp)
    ch = conn.channel()
    print(ch.queue_declare("sslq"))
    ch.publish("", "sslq", "abc")
    print(ch.basic_get("sslq"))