RabbitMQ 管理 ui ssl 密钥文件无效

Question

嗨，我正在使用 Let's Encrypt 为部署在 Azure VM 中的 Dockerized RabbitMQ 生成 SSL 证书。产生与certbot证书后，我得到了cert.pem，chain.pem，fullchain.pem和privkey.pem文件夹中所谓的certs。

之后，我编写了一个 DockerfileDockerfile来基于现有的 RabbitMQ docker 镜像构建docker镜像，如下所示

FROM rabbitmq:3.8-management-alpine
RUN rabbitmq-plugins enable rabbitmq_web_stomp
COPY rabbitmq.conf /etc/rabbitmq/rabbitmq.conf
VOLUME ["/home/rabbitmq/certs"]

另外，我的rabbitmq.conf是

loopback_users.guest = false
listeners.tcp.default = 5672
default_pass = rabbitmq_admin
default_user = rabbitmq_admin
management.tcp.port = 15672
management.ssl.port       = 15671
management.ssl.cacertfile = /home/rabbitmq/certs/chain.pem
management.ssl.certfile   = /home/rabbitmq/certs/cert.pem
management.ssl.keyfile    = /home/rabbitmq/certs/privkey.pem

然后我构建rabbitmq docker镜像

docker build -t rabbitmq:3.8-ssl .

要运行图像，我使用 docker compose 文件作为

version: '3'
services:
  rabbitmq:
    image: rabbitmq:3.8-ssl
    container_name: rabbitmq
    volumes:
       - ./certs:/home/rabbitmq/certs
    deploy:
      resources:
        limits:
          cpus: '0.30'
          memory: 300M
    ports:
      - 4369:4369
      - 5671:5671
      - 5672:5672
      - 15671:15671
      - 15672:15672
      - 15673:15673
      - 15674:15674
      - 25672:25672
    hostname: rabbitmq
    environment:
      - RABBITMQ_DEFAULT_USER=rabbitmq_admin
      - RABBITMQ_DEFAULT_PASS=rabbitmq_admin

然而，当我跑

docker-compose up

我有

Recreating rabbitmq ... done
Attaching to rabbitmq
rabbitmq      |
rabbitmq      | BOOT FAILED
rabbitmq      | ===========
rabbitmq      |
rabbitmq      | Config file generation failed:
rabbitmq      | 23:02:13.719 [error] management.ssl.keyfile invalid, file doesn/t exist or isn't     readable
rabbitmq      | 23:02:13.728 [error] Error generating configuration in phase validation
rabbitmq      | 23:02:13.728 [error] management.ssl.keyfile invalid, file doesn/t exist or isn't     readable
rabbitmq      | In case the setting comes from a plugin, make sure that the plugin is enabled.
rabbitmq      | Alternatively remove the setting from the config.
rabbitmq      |
rabbitmq      | {"init terminating in do_boot",generate_config_file}
rabbitmq      | init terminating in do_boot (generate_config_file)
rabbitmq      |
rabbitmq      | Crash dump is being written to: /var/log/rabbitmq/erl_crash.dump...done
rabbitmq exited with code 0

如果证书有问题，我部署了一个具有相同证书的 nginx Web 服务器（cert.pem并且privkey.pem，似乎 nginx 不需要chain.pem）并且它运行良好。我可以从 chrome 看到证书是有效的。

任何人都可以帮忙看看有什么问题吗？

谢谢

Answer 1

我今天遇到了这个问题。最终结果正如错误所说，rabbitmq 由于权限原因无法查看证书。您可以通过运行来测试

sudo su -l rabbitmq -s /bin/bash

然后尝试查看证书。

rabbitmq@ip-10-0-0-22:~$ cat /etc/letsencrypt/live/www.example.com/fullchain.pem
cat: /etc/letsencrypt/live/www.example.com/fullchain.pem: Permission denied

如果您查看该文件，您会发现它符号链接到存档文件夹，因此仅设置“实时”权限是不够的。

为了解决这个问题，我运行了两个命令来将目录设置为可读。

chmod ugo+rx /etc/letsencrypt/live/