c# - RabbitMQ + C# + SSL

Question

我正在尝试使用 C# 让 RabbitMQ 3.6.2 在 Windows 7 上针对 Erlang 18.0 使用 SSL/TLS。我在 C# 代码中启用 SSL 时遇到错误。我已经完成了设置 SSL/TLS 的步骤 here .我还完成了[故障排除步骤][2]，结果显示成功(除了由于缺乏对 stunnel 的了解而无法执行 stunnel 步骤)。这是我尝试连接到 RabbitMQ 的 C# 代码:

var factory = new ConnectionFactory()
{
    // NOTE: guest username ONLY works with HostName "localhost"!
    //HostName = Environment.MachineName,
    HostName = "localhost",
    UserName = "guest",
    Password = "guest",
};

// Without this line, RabbitMQ.log shows error: "SSL: hello: tls_handshake.erl:174:Fatal error: protocol version"
// When I add this line to go to TLS 1.2, .NET throws an exception: The remote certificate is invalid according to the validation procedure.
//      https://stackoverflow.com/questions/9983265/the-remote-certificate-is-invalid-according-to-the-validation-procedure:
//      Walked through this tutorial to add the client certificate as a Windows Trusted Root Certificate: http://www.sqlservermart.com/HowTo/Windows_Import_Certificate.aspx
factory.Ssl.Version = SslProtocols.Tls12;

factory.Ssl.ServerName = "localhost"; //System.Net.Dns.GetHostName();
factory.Ssl.CertPath = @"C:\OpenSSL-Win64\client\keycert.p12";
factory.Ssl.CertPassphrase = "Re$sp3cMyS3curi1ae!";
factory.Ssl.Enabled = true;
factory.Port = 5671;

// Error: "The remote certificate is invalid according to the validation procedure."
using (var connection = factory.CreateConnection())
{
}

有一个 StackOverflow post关于“远程证书根据验证程序无效”。异常，但 hack 修复似乎没有生效，因为从未调用建议的回调方法。我认为我已将通过 OpenSSL 生成的证书添加到本地计算机的 Windows 受信任的根证书颁发机构证书列表中。所以我在这里不知所措。关于如何进行的任何想法？

编辑:这是为任何努力在 Rabbit 上实现 SSL 的人准备的最终工作代码:

var factory = new ConnectionFactory();
factory.HostName = ConfigurationManager.AppSettings["rabbitmqHostName"];

factory.AuthMechanisms = new AuthMechanismFactory[] { new ExternalMechanismFactory() };
// Note: This should NEVER be "localhost"
factory.Ssl.ServerName = ConfigurationManager.AppSettings["rabbitmqServerName"];
// Path to my .p12 file.
factory.Ssl.CertPath = ConfigurationManager.AppSettings["certificateFilePath"];
// Passphrase for the certificate file - set through OpenSSL
factory.Ssl.CertPassphrase = ConfigurationManager.AppSettings["certificatePassphrase"];
factory.Ssl.Enabled = true;
// Make sure TLS 1.2 is supported & enabled by your operating system
factory.Ssl.Version = SslProtocols.Tls12;
// This is the default RabbitMQ secure port
factory.Port = 5671;
factory.VirtualHost = "/";
// Standard RabbitMQ authentication (if not using ExternalAuthenticationFactory)
//factory.UserName = ConfigurationManager.AppSettings["rabbitmqUsername"];
//factory.Password = ConfigurationManager.AppSettings["rabbitmqPassword"];

using (var connection = factory.CreateConnection())
{
    using (var channel = connection.CreateModel())
    {
        // publish some messages...
    }
}

谢谢，

安迪

Answer 1

通常的问题是您在 Ssl.ServerName 中提供的内容与颁发的主机 SSL 证书不匹配。

另请注意，服务器端 SSL(客户端和服务器之间的加密连接)和使用证书的客户端身份验证(您向服务器提供确认您拥有它期望的证书的信息)是两个不同的事物。通过提供 Ssl.CertPath，您打算使用此证书在服务器上授权，这可能是您想要的，也可能不是您想要的。