Peer Verification

The RabbitMQ Java client prints the following warning:

This means that your connection to our UH Message Broker is not verifying the certificate presented by our server, leaving you vulnerable to unknowingly connecting to an impostor server.

There is documentation from RabbitMQ for addressing this:

• https://www.rabbitmq.com/ssl.html#java-client-connecting-with-peer-verification

  • Verifying our server’s cert:

    • The documentation states that the server certificate must be added to a trust store that will be used to instantiate a Trust Manager. This may not be necessary and it should only be done as a last resort. Most Java environments bundle a cacerts trust store, and common root CAs such as the ones that sign our certs are hopefully already there. If you find yourself needing to add a cert to your Java trust store, first try to add the root cert below. If the root cert alone does not work, you can then try to add the Intermediate(s)/Root cert bundle below to your cacerts trust store. If that fails, you can go ahead and add the server cert (see below) as suggested by the RabbitMQ documentation.

  • You do not need to send a client cert:

    • The documentation references a client certificate, but this is not required. Our RabbitMQ server will accept and verify your client cert if you send one, but there may not be much value in doing so at this moment. Perhaps if we tracked the hostnames allowed to connect, we could verify that your client cert is for one of the allowed hostnames., or maybe we could tie your application’s RabbitMQ account to such a cert. Anyway, using a client cert would make more sense if we were to require every application to connect with a client cert, but that is not currently feasible. For now, we rely on the firewall, TLS encryption and application account password to secure connections into our server.

  • Here is a code example, courtesy of one of our Laulima developers:

  • /* These variables should be passed into the Java App from an external java.properties file rabbitmqConnectionKeyPassphrase=passphraseHere rabbitmqConnectionKeyType=PKCS12 rabbitmqConnectionKeyPath=/path/to/client_key.p12 rabbitmqConnectionKeyManagerType=SunX509 rabbitmqConnectionTruststorePassphrase=<passphrase> rabbitmqConnectionTruststoreType=PKCS                          // or JKS? rabbitmqConnectionTruststorePath=/path/to/trustStore rabbitmqConnectionTrustmanagerFactoryType=SunX509 rabbitmqConnectionSSLContextTLSVersion=TLSv1.2 rabbitmqConnectionConsumerHostName=esb-xxx.its.hawaii.edu rabbitmqConnectionConsumerPort=5671 rabbitmqConnectionConsumerVirtualHost=brokerVhostHere rabbitmqConnectionConsumerUsername=brokerUsernameHere rabbitmqConnectionConsumerPassword=brokerPasswordHere */ private String rabbitmqConnectionConsumerHostName; private String rabbitmqConnectionConsumerQueueName; private String rabbitmqConnectionConsumerExchangeName; private String rabbitmqConnectionConsumerVirtualHost; private String rabbitmqConnectionConsumerUsername; private String rabbitmqConnectionConsumerPassword; private int rabbitmqConnectionConsumerPort = 5671; private String rabbitmqConnectionKeyPath; private String rabbitmqConnectionKeyType; private String rabbitmqConnectionKeyPassphrase; private String rabbitmqConnectionKeyManagerType; private String rabbitmqConnectionTruststorePath; private String rabbitmqConnectionTruststorePassphrase; private String rabbitmqConnectionTruststoreType; private String rabbitmqConnectionTrustmanagerFactoryType; private String rabbitmqConnectionSSLContextTLSVersion;     // set up Rabbit SSL connection options     char[] keyPassphrase = rabbitmqConnectionKeyPassphrase.toCharArray();     KeyStore ks = KeyStore.getInstance(rabbitmqConnectionKeyType);     ks.load(new FileInputStream(rabbitmqConnectionKeyPath), keyPassphrase);     KeyManagerFactory kmf = KeyManagerFactory.getInstance(rabbitmqConnectionKeyManagerType);     kmf.init(ks, keyPassphrase);     char[] trustPassphrase = rabbitmqConnectionTruststorePassphrase.toCharArray();     KeyStore tks = KeyStore.getInstance(rabbitmqConnectionTruststoreType);     tks.load(new FileInputStream(rabbitmqConnectionTruststorePath), trustPassphrase);     TrustManagerFactory tmf = TrustManagerFactory.getInstance(rabbitmqConnectionTrustmanagerFactoryType);     tmf.init(tks);     SSLContext c = SSLContext.getInstance(rabbitmqConnectionSSLContextTLSVersion);     c.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);     ConnectionFactory factory = new ConnectionFactory();     factory.setHost(rabbitmqConnectionConsumerHostName);     factory.setPort(rabbitmqConnectionConsumerPort);     factory.setVirtualHost(rabbitmqConnectionConsumerVirtualHost);     factory.setUsername(rabbitmqConnectionConsumerUsername);     factory.setPassword(rabbitmqConnectionConsumerPassword);     factory.useSslProtocol(c);     factory.enableHostnameVerification();     factory.setRequestedHeartbeat(30);     factory.setAutomaticRecoveryEnabled(true);     factory.setNetworkRecoveryInterval(90000);    // set this to 90s to prevent short lived zombies when network outage is short     Channel channel = null;     connection = factory.newConnection();     channel = connection.createChannel();

• Verify hostname of our server

  • This is straightforward. Your application simply verifies that the hostname it used for the connection to our server matches the hostname in our server’s cert. You only need to call the enableHostnameVerification method as shown in the above sample code.

Root Cert

Root certificates are usually embedded in browsers and your Java environment, so you normally don’t need to install them. Regular updates to your Java environment and OS should bring in the latest root CA certs. If you find yourself needing to add this root cert to your trust store, copy and paste the following to a file with the .pem suffix. You can then reference this file in your configuration or run a command to load its contents into your trust store.

Intermediate(s)/Root Cert Bundle

This cert bundle below should work now and in the near future for all of our test and production servers. You typically copy and paste the text below into a new file with a .pem suffix. You can then reference this file in your configuration or run a command to load its contents into your trust store. If your utility only handles one cert at a time, please create a separate file for each cert in the bundle below, then add each file to your trust store.

This bundle has been updated on 3/22/2023 so that it works with our current and upcoming server certs. It has the “InCommon RSA Server CA” that has been signing all of our certs plus “InCommon RSA Server CA 2” which is signing our newer certs. The old InCommon RSA Server CA cert expires on Sat Oct 5 13:59:59 2024. We will normally remind applications to update this cert bundle when a newer one is available, but if newer certs don’t involve this expired CA and only use new InCommon RSA Server CA 2, then it’s probably OK to just leave the expired cert in the bundle. It will just remain unused and not cause any issues.

Server Cert

As a last resort, you could add the server cert to your trust store. You should only do this if the bundle above did not work. Remember that our server certs expire annually, so be sure to do this every year if you go this route.

You should be able to get our current server cert using the openssl command (choose the one for the desired environment):

• openssl s_client -connect esb.hawaii.edu:5671

• openssl s_client -connect esb-test2.hawaii.edu:5671

• openssl s_client -connect esb-test-future.hawaii.edu:5671

Copy the output lines between BEGIN and END CERTIFICATE inclusive into a file (usually with a .pem suffix). You can then add this file to your trust store.

Feedback

If you implement peer verification of our server, we’d like to hear whether you were able to use it with the default trust store for your Java environment or whether you had to add the root CA, the intermediate/root bundle or the server cert itself and to which trust store. Please share your experiences with us at its-iam-help@lists.hawaii.edu