RabbitMQ For VMware Cloud Director

NOTE:  We found generating the certificate to be rather tricky and made a mistake or two early on.  As a result, some of the inter-node authentications/verifications did not work as described in the RabbitMQ documentation.  Compromises were therefore made inside the inter_node_tls.config file.  If we were to go back and redeploy a RabbitMQ cluster using the certificate instructions contained here, then the compromises in the inter_node_tls.config file would not be needed.

47. Generate a Certificate Signing Request (CSR)
    • Perform these steps on rabbit1
    • Log in to rabbit1 via SSH (root)
    • Edit OpenSSL.cnf configuration file before generating CSR

$ nano /etc/pki/tls/openssl.cnf

• • Find the following lines in openssl.cnf and change them

FROM: # req_extensions = v3_req # The extensions to add to a certificate request
TO:       req_extensions = v3_req # The extensions to add to a certificate request
FROM: countryName_default                  = XX
TO:       countryName_default                  = US

FROM: #stateOrProvinceName_default = Default Province
TO:       stateOrProvinceName_default  =

FROM: localityName_default         = Default City
TO:       localityName_default         =

FROM: 0.organizationName_default    = Default Company Ltd
TO:       0.organizationName_default    =

FIND:   commonName_max                  = 64
TO:       commonName_max                  = 64
TO:       commonName_default            = rabbitvip.domain.local

FIND:   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
TO:       keyUsage = nonRepudiation, digitalSignature, keyEncipherment
TO:       subjectAltName = @alt_names
TO:
TO:       [ alt_names ]
TO:       DNS.1  = rabbitvip.domain.local
TO:       DNS.2  = rabbitvip
TO:       DNS.3  = rabbit1.domain.local
TO:       DNS.4  = rabbit1
TO:       DNS.5  = rabbit2.domain.local
TO:       DNS.6  = rabbit2
TO:       DNS.7  = rabbit3.domain.local
TO:       DNS.8  = rabbit3
TO:       IP.1  = A.A.A.10
TO:       IP.2  = A.A.A.11
TO:       IP.3  = A.A.A.12
TO:       IP.4  = A.A.A.13

• • • Save and close OpenSSL.cnf
    • Generate a CSR
      • Do not provide a password when requested

$ mkdir ~/csr
$ cd ~/csr
$ openssl req -new -newkey rsa:2048 -keyout rabbitmqv2.key -out rabbitmqv2.csr -nodes -config /etc/pki/tls/openssl.cnf -extensions v3_req

48. Prepare RabbitMQ Certificate Template

• • Log in to your Windows domain.local Certificate Authority
  • Open MMC.exe –> Add ‘Certification Authority’ snap-in
  • Expand the tree until you see ‘Certificate Templates’ –> Right-click –> Manage
  • Find template ‘Computer’ –> Right-click –> Duplicate Template –> New window appears
  • Edit tabs:
    • Tab: General
      • Template Display Name: “RabbitMQ Cluster”
      • Validity Period: “3 years”
    • Tab: Cryptography
      • Minimum Key Size: 2048
      • Providers: Microsoft RSA SChannel Cryptographic Provider
    • Tab: Extensions
      • Application Policies –> Edit –> ‘Client Authentication’ and ‘Server Authentication’
      • Key Usage –> Edit –> ‘Digital Signature’ and ‘Key Encipherment’ and ‘Allow Encryption of User Data’
    • Tab: Subject Name
      • Select ‘Supply in the request’
    • Click ‘OK’
  • Close ‘Certificate Templates Console’
  • Go back to the ‘Certification Authority’ snap-in
  • ‘Certificate Templates’ –> Right-click –> New –> ‘Certificate Templates to Issue’
  • Scroll down and find ‘RabbitMQ Cluster’ –> OK
  • Open PowerShell window

PS> Get-CATemplate

• • Verify one of the entries is ‘RabbitMQCluster’

49. Upload the CSR to the Windows Certificate Authority

• • Connect to rabbit1 using WinSCP (root)
  • Download the CSR from /root/csr/rabbitmq.csr
  • Log in to the Certificate Authority (RDP)
  • Copy the CSR to the CA via RDP drag ‘n drop copy

50. Create a Certificate from the CSR

• • On the Windows CA, open a DOS window

DOS> certreq -submit -attrib "CertificateTemplate:RabbitMQCluster"

• • The app will ask you to find and select the CSR file
  • The app will generate a certificate called ‘RabbitMQCluster.cer’
  • Shift-delete the CSR file

51. Export the Root CA Public Certificate
    • On the Windows CA, open a DOS window

DOS> certutil -ca.cert domain.local.CA.cer

52. Copy Certificates from Windows CA to Rabbit1
    • Copy the following certificate from the CA to your laptop
      • cer
      • local.CA.cer
    • Copy the following certificates from your laptop to Laptop to rabbit1 using WinSCP (/root/csr)
      • cer
      • local.CA.cer
    • On rabbit1, move certificate related files

$ mv /root/csr/* /etc/pki/tls/private/
$ cd /etc/pki/tls/private

53. Translate the Certificates to PEM Format

• • Perform these steps on rabbit1
  • Convert RabbitMQCluster.cer to PEM format
  • Convert Certificate Authority chain to PEM format
  • Copy PEM certificates to new location

$ openssl x509 -in RabbitMQCluster.cer  -outform PEM -out rabbitmqcluster.pem
$ openssl x509 -inform DER -outform PEM -in domain.local.CA.cer -out domain.local.CA.cer.pem
$ cp ./rabbitmqcluster.pem             /etc/pki/tls/certs/
$ cp ./rabbitmq.key                    /etc/pki/tls/certs/
$ cp ./domain.local.CA.cer.pem     /etc/pki/tls/certs/
$ chmod 444 /etc/pki/tls/certs/*

54. Copy the Certificate Files to the Other RabbitMQ VMs

• • Copy the following files from rabbit1 to Laptop using WinSCP
    • Source: /etc/pki/tls/certs/rabbitmqcluster.pem
    • Source: /etc/pki/tls/certs/rabbitmq.key
    • Source: /etc/pki/tls/certs/domain.local.CA.cer
  • Copy the following files from Laptop to rabbit2 using WinSCP
    • Destination: /etc/pki/tls/certs/rabbitmqcluster.pem
    • Destination: /etc/pki/tls/certs/rabbitmq.key
    • Destination: /etc/pki/tls/certs/domain.local.CA.cer
  • Copy the following files from Laptop to rabbit3 using WinSCP
    • Destination: /etc/pki/tls/certs/rabbitmqcluster.pem
    • Destination: /etc/pki/tls/certs/rabbitmq.key
    • Destination: /etc/pki/tls/certs/domain.local.CA.cer
  • Set permissions on the files on rabbit2 and rabbit3

$ chmod 444 /etc/pki/tls/certs/*