CentOS-Docker安裝RabbitMQ(單點)配置SSL

RabbitMQ要對外提供服務，考慮到安全性，配置SSL進行訪問，ssl端口5671，內部仍然使用5672進行訪問，兩者同時兼容。

一、生成證書

從github上克隆項目(yum -y install git)
$ cd /home/rabbitmq/
$ git clone https://github.com/Berico-Technologies/CMF-AMQP-Configuration.git
$ cd /home/rabbitmq/CMF-AMQP-Configuration/ssl/

修改證書有效期(可選，默認1年)
$ vi openssl.cnf

default_days = 365

生成證書籤發機構(生成ca目錄)
$ sh setup_ca.sh xxx

生成服務端公鑰和私鑰(生成server目錄)
$ sh make_server_cert.sh rabbit-server 123456

生成客戶端公鑰和私鑰(生成client目錄)
$ sh create_client_cert.sh rabbit-client 123456

JDK導入服務端證書
$ keytool -import -alias rabbit-server -file server/rabbit-server.cert.pem -keystore rabbitStore -storepass 123456

二、安裝RabbitMQ並配置SSL

獲取鏡像

$ docker pull rabbitmq:management

生成配置文件

$ mkdir -p /home/rabbitmq/lib /home/rabbitmq/etc /home/rabbitmq/log
$ docker run --restart=unless-stopped -d -p 5672:5672 -p 15672:15672 --name rabbitmq rabbitmq:management
$ docker cp -a rabbitmq:/var/lib/rabbitmq /home/rabbitmq/lib/
$ docker cp -a rabbitmq:/etc/rabbitmq /home/rabbitmq/etc/
$ docker cp -a rabbitmq:/var/log/rabbitmq /home/rabbitmq/log/

拷貝生成的證書到相對的/home/rabbitmq/etc/rabbitmq/ssl/目錄下

$ cd /home/rabbitmq/CMF-AMQP-Configuration/ssl/
$ mkdir -p /home/rabbitmq/etc/rabbitmq/ssl
$ cp -r ca server client rabbitStore /home/rabbitmq/etc/rabbitmq/ssl

配置SSL信息(追加)

vim /home/rabbitmq/etc/rabbitmq/rabbitmq.conf

# SSL\TLS通信的端口
listeners.ssl.default=5671
# 服務端私鑰和證書文件配置
ssl_options.cacertfile=/etc/rabbitmq/ssl/ca/cacert.pem
ssl_options.certfile=/etc/rabbitmq/ssl/server/rabbit-server.cert.pem
ssl_options.keyfile=/etc/rabbitmq/ssl/server/rabbit-server.key.pem

# 有verify_none和verify_peer兩個選項，verify_none表示完全忽略驗證證書的結果，verify_peer表示要求驗證對方證書
ssl_options.verify=verify_peer
# 若爲true，服務端會向客戶端索要證書，若客戶端無證書則中止SSL握手；若爲false，則客戶端沒有證書時依然可完成SSL握手
ssl_options.fail_if_no_peer_cert=true
ssl_options.versions.1=tlsv1.2
ssl_options.versions.2=tlsv1.1

ssl_options.ciphers.1 = ECDHE-ECDSA-AES256-GCM-SHA384
ssl_options.ciphers.2 = ECDHE-RSA-AES256-GCM-SHA384
ssl_options.ciphers.3 = ECDHE-ECDSA-AES256-SHA384
ssl_options.ciphers.4 = ECDHE-RSA-AES256-SHA384
ssl_options.ciphers.5 = ECDHE-ECDSA-DES-CBC3-SHA
ssl_options.ciphers.6 = ECDH-ECDSA-AES256-GCM-SHA384
ssl_options.ciphers.7 = ECDH-RSA-AES256-GCM-SHA384
ssl_options.ciphers.8 = ECDH-ECDSA-AES256-SHA384
ssl_options.ciphers.9 = ECDH-RSA-AES256-SHA384
ssl_options.ciphers.10 = DHE-DSS-AES256-GCM-SHA384
ssl_options.ciphers.11 = DHE-DSS-AES256-SHA256
ssl_options.ciphers.12 = AES256-GCM-SHA384
ssl_options.ciphers.13 = AES256-SHA256
ssl_options.ciphers.14 = ECDHE-ECDSA-AES128-GCM-SHA256
ssl_options.ciphers.15 = ECDHE-RSA-AES128-GCM-SHA256
ssl_options.ciphers.16 = ECDHE-ECDSA-AES128-SHA256
ssl_options.ciphers.17 = ECDHE-RSA-AES128-SHA256
ssl_options.ciphers.18 = ECDH-ECDSA-AES128-GCM-SHA256
ssl_options.ciphers.19 = ECDH-RSA-AES128-GCM-SHA256
ssl_options.ciphers.20 = ECDH-ECDSA-AES128-SHA256
ssl_options.ciphers.21 = ECDH-RSA-AES128-SHA256
ssl_options.ciphers.22 = DHE-DSS-AES128-GCM-SHA256
ssl_options.ciphers.23 = DHE-DSS-AES128-SHA256
ssl_options.ciphers.24 = AES128-GCM-SHA256
ssl_options.ciphers.25 = AES128-SHA256
ssl_options.ciphers.26 = ECDHE-ECDSA-AES256-SHA
ssl_options.ciphers.27 = ECDHE-RSA-AES256-SHA
ssl_options.ciphers.28 = DHE-DSS-AES256-SHA
ssl_options.ciphers.29 = ECDH-ECDSA-AES256-SHA
ssl_options.ciphers.30 = ECDH-RSA-AES256-SHA
ssl_options.ciphers.31 = AES256-SHA
ssl_options.ciphers.32 = ECDHE-ECDSA-AES128-SHA
ssl_options.ciphers.33 = ECDHE-RSA-AES128-SHA
ssl_options.ciphers.34 = DHE-DSS-AES128-SHA
ssl_options.ciphers.35 = DHE-DSS-AES128-SHA256
ssl_options.ciphers.36 = ECDH-ECDSA-AES128-SHA
ssl_options.ciphers.37 = ECDH-RSA-AES128-SHA
ssl_options.ciphers.38 = AES128-SHA

刪除重建帶有目錄映射的容器

$ docker rm -f -v rabbitmq
$ docker run --restart=unless-stopped -d -p 5672:5672 -p 15672:15672 --name rabbitmq \
-v /home/rabbitmq/etc/rabbitmq:/etc/rabbitmq \
-v /home/rabbitmq/lib/rabbitmq:/var/lib/rabbitmq:z \
-v /home/rabbitmq/log/rabbitmq/:/var/log/rabbitmq \
-e RABBITMQ_DEFAULT_USER=admin -e RABBITMQ_DEFAULT_PASS=123456 rabbitmq:management

查看日誌驗證是否配置成功

$ docker logs -f rabbitmq

 

訪問管理頁面查看是否配置成功

 

SpringBoot集成SSL

spring:
  rabbitmq:
    addresses: 192.168.1.100:5671
    username: admin
    password: 123456
    virtual-host: /
    ssl:
      enabled: true
      key-store: classpath:rabbitmq/ssl/client/rabbit-client.keycert.p12
      key-store-password: 123456
      trust-store: classpath:rabbitmq/ssl/rabbitStore
      trust-store-password: 123456
      algorithm: TLSv1.2
      trust-store-type: JKS
      key-store-type: PKCS12
      validate-server-certificate: true
      verify-hostname: false
 

說明：

ssl使用的是5671的端口，如果不使用ssl還可以使用5672端口
ssl.enabled 是否啓用ssl，默認false
key-store 客戶端證書的存儲路徑
key-store-password 生成客戶端證書的密碼
trust-store 信任證書的存儲路徑
trust-store-password：生成證書的密碼