{"id":3147,"date":"2024-11-26T15:50:28","date_gmt":"2024-11-26T07:50:28","guid":{"rendered":"https:\/\/199604.com\/?p=3147"},"modified":"2024-11-26T15:59:18","modified_gmt":"2024-11-26T07:59:18","slug":"docker%e9%83%a8%e7%bd%b2rabbitmq%e5%bc%80%e5%90%afssl%e4%b8%8espringboot%e8%bf%9e%e6%8e%a5%e6%b5%8b%e8%af%95","status":"publish","type":"post","link":"https:\/\/199604.com\/3147","title":{"rendered":"Docker\u90e8\u7f72RabbitMQ\u5f00\u542fSSL\u4e0eSpringBoot\u8fde\u63a5\u6d4b\u8bd5"},"content":{"rendered":"

Docker\u90e8\u7f72RabbitMQ\u5f00\u542fSSL\u4e0eSpringBoot\u8fde\u63a5\u6d4b\u8bd5<\/h1>\n

\u51c6\u5907\u5de5\u4f5c<\/h2>\n

\u5728\u914d\u7f6e RabbitMQ \u7684 SSL \u4e4b\u524d\uff0c\u9700\u8981\u51c6\u5907 CA \u8bc1\u4e66\u3001\u670d\u52a1\u5668\u8bc1\u4e66\u548c\u5bc6\u94a5\uff0c\u4ee5\u53ca\u5ba2\u6237\u7aef\u8bc1\u4e66\u548c\u5bc6\u94a5\u3002<\/p>\n

\u751f\u6210\u8bc1\u4e66\u548c\u5bc6\u94a5<\/h3>\n

\u4f7f\u7528 OpenSSL \u6765\u751f\u6210\u81ea\u7b7e\u540d\u8bc1\u4e66\u548c\u79c1\u94a5\u3002\u4ee5\u4e0b\u662f\u4e00\u4e2a\u5b8c\u6574\u7684\u6b65\u9aa4\u793a\u4f8b\uff1a<\/p>\n

mkdir \/tmp\/ssl_rabbit && cd \/tmp\/ssl_rabbit\n\n# \u751f\u6210 CA\uff08\u8bc1\u4e66\u9881\u53d1\u673a\u6784\uff09\u79c1\u94a5\u548c\u8bc1\u4e66\n# \u751f\u6210 CA \u79c1\u94a5\nopenssl genrsa -out ca.key 2048\n# \u751f\u6210 CA \u81ea\u7b7e\u540d\u8bc1\u4e66\nopenssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt -subj \"\/C=US\/ST=State\/L=City\/O=Org\/OU=Unit\/CN=MyCA\"\n\n#\u4e3a RabbitMQ \u670d\u52a1\u5668\u751f\u6210\u5bc6\u94a5\u548c\u8bc1\u4e66\u7b7e\u540d\u8bf7\u6c42\uff08CSR\uff09\n# \u751f\u6210\u670d\u52a1\u5668\u79c1\u94a5\nopenssl genrsa -out server.key 2048\n# \u751f\u6210\u670d\u52a1\u5668 CSR\nopenssl req -new -key server.key -out server.csr -subj \"\/C=US\/ST=State\/L=City\/O=Org\/OU=Unit\/CN=localhost\"\n# \u4f7f\u7528 CA \u7b7e\u7f72\u670d\u52a1\u5668\u8bc1\u4e66\nopenssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 3650 -sha256\n\n#\u4e3a\u5ba2\u6237\u7aef\u751f\u6210\u5bc6\u94a5\u548c\u8bc1\u4e66\n# \u751f\u6210\u5ba2\u6237\u7aef\u79c1\u94a5\nopenssl genrsa -out client.key 2048\n# \u751f\u6210\u5ba2\u6237\u7aef CSR\nopenssl req -new -key client.key -out client.csr -subj \"\/C=US\/ST=State\/L=City\/O=Org\/OU=Unit\/CN=Client\"\n# \u4f7f\u7528 CA \u7b7e\u7f72\u5ba2\u6237\u7aef\u8bc1\u4e66\nopenssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 3650 -sha256\n\n#\u5c06 .crt \u548c .key \u6587\u4ef6\u8f6c\u6362\u4e3a .p12 \u683c\u5f0f\uff1a\nopenssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -name rabbitmq-client\n\n#\u7528 RabbitMQ \u670d\u52a1\u7aef\u516c\u94a5\u8bc1\u4e66\u751f\u6210 JKS \u8bc1\u4e66\nkeytool -import -alias rabbitmq-server -file server.crt -keystore server.keystore -storepass Gzeport@123\n\n\u6ce8\u91ca\uff1a\n-import \u5c06\u5df2\u7b7e\u540d\u6570\u5b57\u8bc1\u4e66\u5bfc\u5165\u5bc6\u94a5\u5e93\n-alias xxx  \u6307\u5b9a\u5bfc\u5165\u6761\u76ee\u7684\u522b\u540d\n-file server\/rabbit-server.cert.pem \u9700\u8981\u5bfc\u5165\u7684\u8bc1\u4e66\n-keystore xxx  \u6307\u5b9a\u5bc6\u94a5\u5e93\u7684\u540d\u79f0\n-storepass xxx \u6307\u5b9a\u5bc6\u94a5\u5e93\u7684\u5bc6\u7801(\u83b7\u53d6keystore\u4fe1\u606f\u6240\u9700\u7684\u5bc6\u7801)\n<\/code><\/pre>\n
\n
    \n
  • ca.crt<\/code>\uff1aCA \u8bc1\u4e66<\/li>\n
  • server.key<\/code> \u548c server.crt<\/code>\uff1aRabbitMQ \u670d\u52a1\u5668\u7684\u79c1\u94a5\u548c\u8bc1\u4e66<\/li>\n
  • client.key<\/code> \u548c client.crt<\/code>\uff1a\u5ba2\u6237\u7aef\u7684\u79c1\u94a5\u548c\u8bc1\u4e66<\/li>\n
  • client.p12<\/code>\u548cserver.keystore<\/code>: java\u5ba2\u6237\u7aef\u8fde\u63a5\u4f7f\u7528<\/li>\n<\/ul>\n<\/blockquote>\n
    \u914d\u7f6e RabbitMQ \u542f\u7528 SSL<\/h2>\n
    RabbitMQ \u4f7f\u7528\u914d\u7f6e\u6587\u4ef6\uff08rabbitmq.conf<\/code> \uff09\u6765\u542f\u7528 SSL<\/p>\n
    # \u542f\u7528 SSL \u76d1\u542c\nlisteners.ssl.default = 5671\n\n# \u6307\u5b9a\u6587\u4ef6\u8def\u5f84\nssl_options.cacertfile = \/etc\/rabbitmq\/ssl\/ca.crt\nssl_options.certfile = \/etc\/rabbitmq\/ssl\/server.crt\nssl_options.keyfile = \/etc\/rabbitmq\/ssl\/server.key\n\n# \u9a8c\u8bc1\u5ba2\u6237\u7aef\u8bc1\u4e66\nssl_options.verify = verify_peer\nssl_options.fail_if_no_peer_cert = true\n\n# \u6307\u5b9a\u652f\u6301\u7684\u534f\u8bae\u7248\u672c\uff08\u53ef\u9009\uff09\nssl_options.versions.1 = tlsv1.2\nssl_options.versions.2 = tlsv1.3\n\n<\/code><\/pre>\n
    enabled_plugins<\/code>\u6587\u4ef6<\/p>\n
    [rabbitmq_auth_mechanism_ssl,rabbitmq_management].\n<\/code><\/pre>\n
    Docker compose\u90e8\u7f72Rabbitmq<\/h2>\n
    \u521b\u5efa\u76ee\u5f55\u4e0e\u590d\u5236\u8bc1\u4e66<\/h3>\n
    mkdir -p \/AppHome\/rabbitmq\nmkdir -p \/AppHome\/rabbitmq\/data\nmkdir -p \/AppHome\/rabbitmq\/etc\/ssl\nmkdir -p \/AppHome\/rabbitmq\/logs && chmo 777 \/AppHome\/rabbitmq\/logs\n\ncp \/tmp\/ssl_rabbit\/* \/AppHome\/rabbitmq\/etc\/ssl\/\n\n# \u76ee\u5f55\u6e05\u5355\u5982\u4e0b\uff1a\n[root@localhost rabbitmq]# tree .\/\n.\/\n\u251c\u2500\u2500 data\n\u251c\u2500\u2500 docker-compose.yml\n\u251c\u2500\u2500 etc\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 enabled_plugins\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 rabbitmq.conf\n\u2502\u00a0\u00a0 \u2514\u2500\u2500 ssl\n\u2502\u00a0\u00a0     \u251c\u2500\u2500 ca.crt\n\u2502\u00a0\u00a0     \u251c\u2500\u2500 ca.key\n\u2502\u00a0\u00a0     \u251c\u2500\u2500 ca.srl\n\u2502\u00a0\u00a0     \u251c\u2500\u2500 client.crt\n\u2502\u00a0\u00a0     \u251c\u2500\u2500 client.csr\n\u2502\u00a0\u00a0     \u251c\u2500\u2500 client.key\n\u2502\u00a0\u00a0     \u251c\u2500\u2500 client.p12\n\u2502\u00a0\u00a0     \u251c\u2500\u2500 server.crt\n\u2502\u00a0\u00a0     \u251c\u2500\u2500 server.csr\n\u2502\u00a0\u00a0     \u251c\u2500\u2500 server.key\n\u2502\u00a0\u00a0     \u2514\u2500\u2500 server.keystore\n\u2514\u2500\u2500 logs\n    \u2514\u2500\u2500 rabbit@rabbitmq.log\n\n<\/code><\/pre>\n
    docker-compose.yml<\/h3>\n
    version: '3'\nservices:\n  rabbitmq:\n    hostname: rabbitmq\n    container_name: rabbitmq\n    image: docker.199604.com\/library\/rabbitmq:4.0.4-management\n    restart: always\n    ulimits:\n      nofile:\n        soft: 65536\n        hard: 65536\n    environment:\n      - TZ=Asia\/Shanghai\n      - RABBITMQ_DEFAULT_USER=glj\n      - RABBITMQ_DEFAULT_PASS=glj@123\n    volumes:\n      - \/AppHome\/rabbitmq\/data:\/var\/lib\/rabbitmq\n      - \/AppHome\/rabbitmq\/etc:\/etc\/rabbitmq\/\n      - \/AppHome\/rabbitmq\/logs:\/var\/log\/rabbitmq\/\n    ports:\n      - 5671:5671\n      - 5672:5672\n      - 15672:15672\n<\/code><\/pre>\n
    \u542f\u52a8\u5bb9\u5668<\/h4>\n
    docker-compose up -d \n\n# \u67e5\u770b\u5bb9\u5668\u6b63\u5e38\u542f\u52a8\n[root@host146 logs]# docker logs -f b2c8c7215d65\n2024-11-26 14:29:56.940431+08:00 [notice] <0.45.0> Application syslog exited with reason: stopped\n2024-11-26 14:29:56.949526+08:00 [notice] <0.216.0> Logging: switching to configured handler(s); following messages may not be visible in this log output\n\n  ##  ##      RabbitMQ 4.0.4\n  ##  ##\n  ##########  Copyright (c) 2007-2024 Broadcom Inc and\/or its subsidiaries\n  ######  ##\n  ##########  Licensed under the MPL 2.0. Website: https:\/\/rabbitmq.com\n\n  Erlang:      27.1.2 [jit]\n  TLS Library: OpenSSL - OpenSSL 3.3.2 3 Sep 2024\n  Release series support status: see https:\/\/www.rabbitmq.com\/release-information\n\n  Doc guides:  https:\/\/www.rabbitmq.com\/docs\n  Support:     https:\/\/www.rabbitmq.com\/docs\/contact\n  Tutorials:   https:\/\/www.rabbitmq.com\/tutorials\n  Monitoring:  https:\/\/www.rabbitmq.com\/docs\/monitoring\n  Upgrading:   https:\/\/www.rabbitmq.com\/docs\/upgrade\n\n  Logs: \/var\/log\/rabbitmq\/rabbit@rabbitmq.log\n        <stdout>\n\n  Config file(s): \/etc\/rabbitmq\/rabbitmq.conf\n\n  Starting broker... completed with 3 plugins.\n\n\n\n\n#\u67e5\u770b\u76d1\u542c\nrabbitmq-diagnostics listeners\n#\u67e5\u770b\u652f\u6301\u7684TLS\u7248\u672c\nrabbitmq-diagnostics --silent tls_versions\n<\/code><\/pre>\n
    \"image-20241126153926401\"<\/div><\/p>\n
    \"image-20230217084003341\"<\/div><\/p>\n
    \u6d4b\u8bd5 SSL \u914d\u7f6e<\/h2>\n
    \u5728 RabbitMQ \u914d\u7f6e SSL \u540e\uff0c\u4f60\u53ef\u4ee5\u4f7f\u7528 OpenSSL \u6216\u5ba2\u6237\u7aef\u5de5\u5177\u6d4b\u8bd5\u8fde\u63a5\u3002<\/p>\n
    \u4f7f\u7528 openssl s_client<\/code> \u6d4b\u8bd5<\/h3>\n
    \u4ece\u5ba2\u6237\u7aef\u673a\u5668\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\uff0c\u6d4b\u8bd5\u4e0e RabbitMQ \u7684 SSL \u8fde\u63a5\uff1a<\/p>\n
    #\u4f7f\u7528\u5ba2\u6237\u7aef\u8bc1\u4e66+CA\u8bc1\u4e66\u8fde\u63a5RabbitMQ\u9a8c\u8bc1\u3002\u672c\u5904MQ\u4e0e\u751f\u6210\u8bc1\u4e66\u662f\u540c\u4e00\u4e3b\u673a\uff0c\u5176\u4ed6\u60c5\u51b5\u8bf7\u81ea\u884c\u8003\u8651\u3002\nopenssl s_client -connect 127.0.0.1:5671 -cert client.crt -key client.key -CAfile ca.crt\n<\/code><\/pre>\n
    \"image-20241126154258988\"<\/div><\/p>\n
    \n  \u6210\u529f\u8fde\u63a5\u65f6\uff0c\u5e94\u8be5\u80fd\u770b\u5230\u5305\u542b Verify return code: 0 (ok) \u7684\u8f93\u51fa\u3002\n<\/p><\/blockquote>\n
    \u4f7f\u7528 RabbitMQ \u5ba2\u6237\u7aef\u6d4b\u8bd5<\/h3>\n
    Spring Boot \u793a\u4f8b\u914d\u7f6e\uff08application.yml<\/code>\uff09\uff1a<\/p>\n
    spring:\n  application:\n    name: rabbitmq-consumer-boot\n\n  rabbitmq:\n    host: 192.168.100.150\n    port: 5671\n    username: glj\n    password: glj@123\n    #\u865a\u62dfhost \u53ef\u4ee5\u4e0d\u8bbe\u7f6e,\u4f7f\u7528server\u9ed8\u8ba4host\n    virtual-host: \/\n    ssl:\n      enabled: true\n      key-store: classpath:ssl\/client.p12\n      key-store-password: Gzeport@123\n      key-store-type: PKCS12\n      trust-store: classpath:ssl\/server.keystore\n      trust-store-type: JKS\n      algorithm: TLSv1.2\n      validate-server-certificate: true\n      verify-hostname: false\n<\/code><\/pre>\n
    \"image-20241126154501622\"<\/div><\/p>\n
    \"image-20241126154513296\"<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"
    Docker\u90e8\u7f72RabbitMQ\u5f00\u542fSSL\u4e0eSpringBoot\u8fde\u63a5\u6d4b\u8bd5 \u51c6\u5907\u5de5\u4f5c \u5728\u914d\u7f6e RabbitMQ  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[332,477],"tags":[226,341],"class_list":["post-3147","post","type-post","status-publish","format-standard","hentry","category-docker","category-rabbitmq","tag-docker","tag-rabbitmq"],"_links":{"self":[{"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/posts\/3147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/comments?post=3147"}],"version-history":[{"count":2,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/posts\/3147\/revisions"}],"predecessor-version":[{"id":3149,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/posts\/3147\/revisions\/3149"}],"wp:attachment":[{"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/media?parent=3147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/categories?post=3147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/tags?post=3147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}