search

rabbitmq / rabbitmq-server

Open source RabbitMQ: core server and tier 1 (built-in) plugins
https://www.rabbitmq.com/
Other
11.86k stars 3.9k forks source link

Use the `public_key:cacerts_get/0` function when appropriate #10519

Open lukebakken opened 5 months ago

lukebakken commented 5 months ago

References:

API: https://www.erlang.org/doc/man/public_key#cacerts_get-0

Anywhere SSl/TLS is configured in RabbitMQ, if the user does not configure cacertfile or cacerts, RabbitMQ should automatically use public_key:cacerts_get/0 to load the system certificates.

If, after doing all of that, RabbitMQ could set verify to verify_none. Otherwise, the ssl functions will fail as reported in https://github.com/erlang/otp/issues/8066

Note that I've never seen cacerts used in practice.

michaelklishin commented 5 months ago

I don't think that we should widely fall back to verify_none. Certainly not for client connections. using public_key:cacerts_get/0 as a fallback is a good idea.