ssl - RabbitMQ 管理 ui ssl keyfile 无效

Question

您好我正在使用 Let's Encrypt 为部署在 Azure VM 中的 Dockerized RabbitMQ 生成 SSL 证书。使用 certbot 生成证书后，我得到了 cert.pem , chain.pem , fullchain.pem和 privkey.pem在名为 certs 的文件夹中.

之后，我写了一个 Dockerfile Dockerfile根据现有的 RabbitMQ docker 镜像构建 docker 镜像，如下所示

FROM rabbitmq:3.8-management-alpine
RUN rabbitmq-plugins enable rabbitmq_web_stomp
COPY rabbitmq.conf /etc/rabbitmq/rabbitmq.conf
VOLUME ["/home/rabbitmq/certs"]

另外，我的 rabbitmq.conf是

loopback_users.guest = false
listeners.tcp.default = 5672
default_pass = rabbitmq_admin
default_user = rabbitmq_admin
management.tcp.port = 15672
management.ssl.port       = 15671
management.ssl.cacertfile = /home/rabbitmq/certs/chain.pem
management.ssl.certfile   = /home/rabbitmq/certs/cert.pem
management.ssl.keyfile    = /home/rabbitmq/certs/privkey.pem

然后我用构建rabbitmq docker镜像
docker build -t rabbitmq:3.8-ssl .
要运行图像，我使用 docker compose 文件作为

version: '3'
services:
  rabbitmq:
    image: rabbitmq:3.8-ssl
    container_name: rabbitmq
    volumes:
       - ./certs:/home/rabbitmq/certs
    deploy:
      resources:
        limits:
          cpus: '0.30'
          memory: 300M
    ports:
      - 4369:4369
      - 5671:5671
      - 5672:5672
      - 15671:15671
      - 15672:15672
      - 15673:15673
      - 15674:15674
      - 25672:25672
    hostname: rabbitmq
    environment:
      - RABBITMQ_DEFAULT_USER=rabbitmq_admin
      - RABBITMQ_DEFAULT_PASS=rabbitmq_admin

但是，当我运行时
docker-compose up
我有

Recreating rabbitmq ... done
Attaching to rabbitmq
rabbitmq      |
rabbitmq      | BOOT FAILED
rabbitmq      | ===========
rabbitmq      |
rabbitmq      | Config file generation failed:
rabbitmq      | 23:02:13.719 [error] management.ssl.keyfile invalid, file doesn/t exist or isn't     readable
rabbitmq      | 23:02:13.728 [error] Error generating configuration in phase validation
rabbitmq      | 23:02:13.728 [error] management.ssl.keyfile invalid, file doesn/t exist or isn't     readable
rabbitmq      | In case the setting comes from a plugin, make sure that the plugin is enabled.
rabbitmq      | Alternatively remove the setting from the config.
rabbitmq      |
rabbitmq      | {"init terminating in do_boot",generate_config_file}
rabbitmq      | init terminating in do_boot (generate_config_file)
rabbitmq      |
rabbitmq      | Crash dump is being written to: /var/log/rabbitmq/erl_crash.dump...done
rabbitmq exited with code 0

如果证书有问题，我部署了一个具有相同证书的 nginx Web 服务器( cert.pem 和 privkey.pem ，似乎 nginx 不需要 chain.pem )并且运行良好。我可以从 chrome 中看到证书是有效的。

谁能帮忙看看有什么问题？

谢谢

Answer 1

我今天遇到了这个问题。最终结果正如错误所说，rabbitmq 由于权限而无法查看证书。您可以通过运行进行测试

sudo su -l rabbitmq -s /bin/bash

然后尝试查看证书。

rabbitmq@ip-10-0-0-22:~$ cat /etc/letsencrypt/live/www.example.com/fullchain.pem
cat: /etc/letsencrypt/live/www.example.com/fullchain.pem: Permission denied

如果您查看该文件，您会发现它符号链接(symbolic link)到存档文件夹，因此仅在“实时”上设置权限是不够的。
为了解决这个问题，我运行了两个命令来将目录设置为可读。

chmod ugo+rx /etc/letsencrypt/live/