rabbitmq-objc-client not working with self signed Certificate

[tonyli508]

see the log output below:

2017-08-29 19:47:10.628 TOFS[34562:14394129] sslReadWithBuffer:0x7fbffb825a00 length:5 2017-08-29 19:47:10.628 TOFS[34562:14394129] sslReadWithBuffer:length: - No data available to read... 2017-08-29 19:47:10.629 TOFS[34562:14394129] SSLHandshake continues... 2017-08-29 19:47:10.629 TOFS[34562:14394129] Adding streams to runloop... 2017-08-29 19:47:10.629 TOFS[34562:14394129] Opening read and write stream... 2017-08-29 19:47:10.732 TOFS[34562:14395349] readEventBlock 2017-08-29 19:47:10.732 TOFS[34562:14395349] socketFDBytesAvailable: 87 2017-08-29 19:47:10.732 TOFS[34562:14395349] Waiting for SSL/TLS handshake to complete 2017-08-29 19:47:10.732 TOFS[34562:14395349] sslReadWithBuffer:0x7fbffb825a00 length:5 2017-08-29 19:47:10.733 TOFS[34562:14395349] sslReadWithBuffer:length:: Reading from socket... 2017-08-29 19:47:10.733 TOFS[34562:14395349] sslReadWithBuffer:length:: Reading into sslPreBuffer... 2017-08-29 19:47:10.733 TOFS[34562:14395349] sslReadWithBuffer:length:: read from socket = 87 2017-08-29 19:47:10.733 TOFS[34562:14395349] sslReadWithBuffer:length:: Copying 5 bytes out of sslPreBuffer 2017-08-29 19:47:10.733 TOFS[34562:14395349] sslReadWithBuffer:length:: sslPreBuffer.length = 82 2017-08-29 19:47:10.734 TOFS[34562:14395349] sslReadWithBuffer:length:: Complete 2017-08-29 19:47:10.734 TOFS[34562:14395349] sslReadWithBuffer:0x7fbffb825a05 length:82 2017-08-29 19:47:10.734 TOFS[34562:14395349] sslReadWithBuffer:length:: Reading from SSL pre buffer... 2017-08-29 19:47:10.734 TOFS[34562:14395349] sslReadWithBuffer:length:: Copying 82 bytes from sslPreBuffer 2017-08-29 19:47:10.752 TOFS[34562:14395349] sslReadWithBuffer:length:: sslPreBuffer.length = 0 2017-08-29 19:47:10.752 TOFS[34562:14395349] sslReadWithBuffer:length:: Complete 2017-08-29 19:47:10.753 TOFS[34562:14395349] sslReadWithBuffer:0x7fbffb825a00 length:5 2017-08-29 19:47:10.753 TOFS[34562:14395349] sslReadWithBuffer:length: - No data available to read... 2017-08-29 19:47:10.753 TOFS[34562:14395349] SSLHandshake continues... 2017-08-29 19:47:10.753 TOFS[34562:14395349] readEventBlock 2017-08-29 19:47:10.753 TOFS[34562:14395349] socketFDBytesAvailable: 2185 2017-08-29 19:47:10.754 TOFS[34562:14395349] Waiting for SSL/TLS handshake to complete 2017-08-29 19:47:10.754 TOFS[34562:14395349] sslReadWithBuffer:0x7fbffb825a00 length:5 2017-08-29 19:47:10.754 TOFS[34562:14395349] sslReadWithBuffer:length:: Reading from socket... 2017-08-29 19:47:10.754 TOFS[34562:14395349] sslReadWithBuffer:length:: Reading into sslPreBuffer... 2017-08-29 19:47:10.754 TOFS[34562:14395349] sslReadWithBuffer:length:: read from socket = 2185 2017-08-29 19:47:10.754 TOFS[34562:14395349] sslReadWithBuffer:length:: Copying 5 bytes out of sslPreBuffer 2017-08-29 19:47:10.755 TOFS[34562:14395349] sslReadWithBuffer:length:: sslPreBuffer.length = 2180 2017-08-29 19:47:10.755 TOFS[34562:14395349] sslReadWithBuffer:length:: Complete 2017-08-29 19:47:10.755 TOFS[34562:14395349] sslReadWithBuffer:0x7fbffb825a05 length:1833 2017-08-29 19:47:10.755 TOFS[34562:14395349] sslReadWithBuffer:length:: Reading from SSL pre buffer... 2017-08-29 19:47:10.755 TOFS[34562:14395349] sslReadWithBuffer:length:: Copying 1833 bytes from sslPreBuffer 2017-08-29 19:47:10.756 TOFS[34562:14395349] sslReadWithBuffer:length:: sslPreBuffer.length = 347 2017-08-29 19:47:10.756 TOFS[34562:14395349] sslReadWithBuffer:length:: Complete 2017-08-29 19:47:10.756 TOFS[34562:14395349] sslReadWithBuffer:0x7fbffb825a00 length:5 2017-08-29 19:47:10.756 TOFS[34562:14395349] sslReadWithBuffer:length:: Reading from SSL pre buffer... 2017-08-29 19:47:10.756 TOFS[34562:14395349] sslReadWithBuffer:length:: Copying 5 bytes from sslPreBuffer 2017-08-29 19:47:10.757 TOFS[34562:14395349] sslReadWithBuffer:length:: sslPreBuffer.length = 342 2017-08-29 19:47:10.757 TOFS[34562:14395349] sslReadWithBuffer:length:: Complete 2017-08-29 19:47:10.757 TOFS[34562:14395349] sslReadWithBuffer:0x7fbffb825a05 length:333 2017-08-29 19:47:10.757 TOFS[34562:14395349] sslReadWithBuffer:length:: Reading from SSL pre buffer... 2017-08-29 19:47:10.757 TOFS[34562:14395349] sslReadWithBuffer:length:: Copying 333 bytes from sslPreBuffer 2017-08-29 19:47:10.757 TOFS[34562:14395349] sslReadWithBuffer:length:: sslPreBuffer.length = 9 2017-08-29 19:47:10.758 TOFS[34562:14395349] sslReadWithBuffer:length:: Complete 2017-08-29 19:47:10.762 TOFS[34562:14395349] Removing streams from runloop... 2017-08-29 19:47:10.763 TOFS[34562:14395349] dispatch_source_cancel(readSource) 2017-08-29 19:47:10.763 TOFS[34562:14395349] dispatch_source_cancel(writeSource) 2017-08-29 19:47:10.763 TOFS[34562:14395349] dispatch_resume(writeSource) 2017-08-29 19:47:10.764 TOFS[34562:14395349] readCancelBlock 2017-08-29 19:47:10.764 TOFS[34562:14395349] dispatchrelease(readSource) [D] [function: connection(:disconnectedWithError:)] - AMQPEventSyncer --- Received connection: Optional(<RMQConnection: 0x6180000fab00>) disconnectedWithError: Optional(Error Domain=kCFStreamErrorDomainSSL Code=-9800 "(null)" UserInfo={NSLocalizedRecoverySuggestion=Error code definition can be found in Apple's SecureTransport.h}) - [file: AMQPEventSyncer] 2017-08-29 19:47:10.764 TOFS[34562:14395349] writeCancelBlock 2017-08-29 19:47:10.764 TOFS[34562:14395349] dispatch_release(writeSource) 2017-08-29 19:47:10.764 TOFS[34562:14395349] close(socketFD)

[michaelklishin]

Thank you for your time.

Team RabbitMQ uses GitHub issues for specific actionable items engineers can work on. This assumes two things:

1. GitHub issues are not used for questions, investigations, root cause analysis, discussions of potential issues, etc (as defined by this team)
2. We have a certain amount of information to work with

We get at least a dozen of questions through various venues every single day, often quite light on details. At that rate GitHub issues can very quickly turn into a something impossible to navigate and make sense of even for our team. Because of that questions, investigations, root cause analysis, discussions of potential features are all considered to be mailing list material by our team. Please post this to rabbitmq-users.

Getting all the details necessary to reproduce an issue, make a conclusion or even form a hypothesis about what's happening can take a fair amount of time. Our team is multiple orders of magnitude smaller than the RabbitMQ community. Please help others help you by providing a way to reproduce the behavior you're observing, or at least sharing as much relevant information as possible on the list:

• Server, client library and plugin (if applicable) versions used
• Server logs
• A code example or terminal transcript that can be used to reproduce
• Full exception stack traces (not a single line message)
• rabbitmqctl status (and, if possible, rabbitmqctl environment output)
• Other relevant things about the environment and workload, e.g. a traffic capture

Feel free to edit out hostnames and other potentially sensitive information.

When/if we have enough details and evidence we'd be happy to file a new issue.

Thank you.

[michaelklishin]

Clients such as this one are not aware of whether a certificate is self-signed or not. They either can find a trusted one in the provided chain or not. Add the self-signed root certificate to the trusted store of your OS and

See Troubleshooting TLS in RabbitMQ docs. I'm quite sure the issue is environment-specific, as well over 90% of TLS questions are.

[michaelklishin]

According to a few Google results, iOS 9 and later versions require the server to only support TLSv1.2. Not sure if this applies to all TCP connections or only HTTP[S] requests.

Either way, RabbitMQ TLS docs have a section on TLS versions, how to limit them and what the implications are for older runtimes (e.g. JDK 6) if you have to interoperate with them.

[michaelklishin]

And, of course, see RabbitMQ logs. All TLS alerts and TCP connection events [except for connections that send no data] are logged.

[702646994]

rabbitmq-objc-client not working with self signed Certificate？有两种方式忽略ssl校验。 方式1、修改RMQTLSOptions.m：

• (instancetype)fromURI:(NSString *)uri { /// RMQ连接 --- 默认不校验ssl return [RMQTLSOptions fromURI:uri verifyPeer:NO]; }

方式2、修改RMQTCPSocketTransport.m： 增加如下GCDAsyncSocket回调，在回调中进行🤝校验

• (void)socket:(GCDAsyncSocket *)sock didReceiveTrust:(SecTrustRef)trust completionHandler:(void (^)(BOOL shouldTrustPeer))completionHandler;

[michaelklishin]

Instead of disabling peer verification, which is only a reasonable thing to do in test environments, make sure that both server and client trust each others' certificate chains (or rather the root of the chain, or an intermediate certificate, if any).