---
id: a5094351-9f1b-47d1-9ebd-93ade420371c
---

# RabbitMQ SSL Certificate Expiry
---

This incident type refers to situations where the SSL (Secure Sockets Layer) certificate used by RabbitMQ, a popular open-source message broker software, has expired. This can lead to issues with secure communications and potentially cause disruptions in the messaging system's functionality. It is important to promptly renew the SSL certificate to avoid any negative impact on system performance and security.

### Parameters
```shell
export PATH_TO_CERTIFICATE_FILE="PLACEHOLDER"

export PATH_TO_CA_CERTIFICATES="PLACEHOLDER"

export RABBITMQ_HOST="PLACEHOLDER"

export NEW_CERTIFICATE_EXPIRY="PLACEHOLDER"

export NEW_CERTIFICATE_NAME="PLACEHOLDER"

export RABBITMQ_CONFIG_FILE="PLACEHOLDER"
```

## Debug

### Check for RabbitMQ SSL certificate expiration date
```shell
openssl x509 -enddate -noout -in ${PATH_TO_CERTIFICATE_FILE}
```

### Check RabbitMQ logs for SSL related issues
```shell
journalctl -u rabbitmq-server | grep SSL
```

### Verify RabbitMQ SSL configuration
```shell
rabbitmqctl eval 'ssl:versions().'

rabbitmqctl eval 'ssl:ciphers().'

rabbitmqctl eval 'ssl:versions_fallback().'

rabbitmqctl eval 'ssl:versions_disabled().'
```

### Check RabbitMQ SSL port status
```shell
ss -tulwn | grep 5671
```

### Verify SSL certificate chain
```shell
openssl verify -verbose -CAfile ${PATH_TO_CA_CERTIFICATES} ${PATH_TO_CERTIFICATE_FILE}
```

### Verify SSL connection to RabbitMQ server
```shell
openssl s_client -connect ${RABBITMQ_HOST}:5671
```

## Repair

### Generate a new SSL certificate with a valid expiration date and update it in the RabbitMQ configuration.
```shell
bash

#!/bin/bash



# Set variables

CERT_NAME=${NEW_CERTIFICATE_NAME}

CERT_EXPIRY=${NEW_CERTIFICATE_EXPIRY}

RABBITMQ_CONFIG=${RABBITMQ_CONFIG_FILE}



# Generate new SSL certificate

openssl req -newkey rsa:2048 -nodes -keyout $CERT_NAME.key \

    -x509 -days $CERT_EXPIRY -out $CERT_NAME.crt



# Update RabbitMQ configuration

sudo sed -i "s/ssl_certfile.*/ssl_certfile = \/path\/to\/$CERT_NAME.crt/" $RABBITMQ_CONFIG

sudo sed -i "s/ssl_keyfile.*/ssl_keyfile = \/path\/to\/$CERT_NAME.key/" $RABBITMQ_CONFIG



# Restart RabbitMQ service

sudo systemctl restart rabbitmq-server


```

This incident type refers to situations where the SSL (Secure Sockets Layer) certificate used by RabbitMQ, a popular open-source message broker software, has expired. This can lead to issues with secure communications and potentially cause disruptions in the messaging system's functionality. It is important to promptly renew the SSL certificate to avoid any negative impact on system performance and security.


```shell
export PATH_TO_CERTIFICATE_FILE="PLACEHOLDER"

export PATH_TO_CA_CERTIFICATES="PLACEHOLDER"

export RABBITMQ_HOST="PLACEHOLDER"

export NEW_CERTIFICATE_EXPIRY="PLACEHOLDER"

export NEW_CERTIFICATE_NAME="PLACEHOLDER"

export RABBITMQ_CONFIG_FILE="PLACEHOLDER"
```


### Check for RabbitMQ SSL certificate expiration date

```shell
openssl x509 -enddate -noout -in ${PATH_TO_CERTIFICATE_FILE}
```

### Check RabbitMQ logs for SSL related issues

```shell
journalctl -u rabbitmq-server | grep SSL
```

### Verify RabbitMQ SSL configuration

```shell
rabbitmqctl eval 'ssl:versions().'

rabbitmqctl eval 'ssl:ciphers().'

rabbitmqctl eval 'ssl:versions_fallback().'

rabbitmqctl eval 'ssl:versions_disabled().'
```

### Check RabbitMQ SSL port status

```shell
ss -tulwn | grep 5671
```

### Verify SSL certificate chain

```shell
openssl verify -verbose -CAfile ${PATH_TO_CA_CERTIFICATES} ${PATH_TO_CERTIFICATE_FILE}
```

### Verify SSL connection to RabbitMQ server

```shell
openssl s_client -connect ${RABBITMQ_HOST}:5671
```


### Generate a new SSL certificate with a valid expiration date and update it in the RabbitMQ configuration.

```shell
bash

#!/bin/bash



# Set variables

CERT_NAME=${NEW_CERTIFICATE_NAME}

CERT_EXPIRY=${NEW_CERTIFICATE_EXPIRY}

RABBITMQ_CONFIG=${RABBITMQ_CONFIG_FILE}



# Generate new SSL certificate

openssl req -newkey rsa:2048 -nodes -keyout $CERT_NAME.key \

    -x509 -days $CERT_EXPIRY -out $CERT_NAME.crt



# Update RabbitMQ configuration

sudo sed -i "s/ssl_certfile.*/ssl_certfile = \/path\/to\/$CERT_NAME.crt/" $RABBITMQ_CONFIG

sudo sed -i "s/ssl_keyfile.*/ssl_keyfile = \/path\/to\/$CERT_NAME.key/" $RABBITMQ_CONFIG



# Restart RabbitMQ service

sudo systemctl restart rabbitmq-server


```


RabbitMQ SSL Certificate Expiry

Overview

Parameters

Debug

Check for RabbitMQ SSL certificate expiration date

Verify RabbitMQ SSL configuration

Check RabbitMQ SSL port status

Verify SSL certificate chain

Verify SSL connection to RabbitMQ server

Repair

Generate a new SSL certificate with a valid expiration date and update it in the RabbitMQ configuration.

Learn more

Related Runbooks

Support