tls connection without verify peer failed

[wiryonolau]

Hi I want to test tls connection without verifying

Client is php 7.4.33 and Server is Rabbitmq 3.12 both running from docker
without tls everything run flawlessly

I'm also testing with python since it will communicate with it later. Using aio-pika, this is work normally
Note that I'm not providing any certificate ( skip verify )
amqps://principal:principal@localhost:5671/?no_verify_ssl=1

$amqpConfig = new AMQPConnectionConfig();
$amqpConfig->setHost("localhost");
$amqpConfig->setPort(5671);
$amqpConfig->setUser("principal");
$amqpConfig->setPassword("principal");
$amqpConfig->setIsSecure(true);
$amqpConfig->setSslVerify(false);
$amqpConfig->setSslVerifyName(false);
$amqpConfig->setIoType(AMQPConnectionConfig::IO_TYPE_STREAM);
$amqpConfig->setVhost("/");

$connection = AMQPConnectionFactory::create($amqpConfig);

I got this error Server not ready - Invalid frame type 21 on PHP
and this error in rabbitmq

{unsupported_record_type,65}
TLS server: In state hello at tls_record.erl:564 generated SERVER ALERT: Fatal - Unexpected Message

Any idea how to further debug ?

[lukebakken]

It appears you have not configured RabbitMQ to use TLS.

If you'd like us to assist please provide a docker compose project that I can clone and run to see the same issue you report, or at the very least, provide all of your RabbitMQ configuration (including certificates) as well as your PHP and aio-pika test code. Thanks.

[lukebakken]

Actually, I have spent enough time on reproducing this issue. I would like you, @wiryonolau, to fork my repository ...

https://github.com/lukebakken/php-amqplib-1105

...and open a pull request that finishes the work I have started. The only thing that needs to be done is to make it so that running make run-aio-pika-repro and make run-php-repro actually do something.

I copied your aio-pika code into this file:

https://github.com/lukebakken/php-amqplib-1105/blob/main/aio-pika/repro.py

To run it standalone, you would do this:

cd aio-pika
pipenv install --dev
pipenv run repro

But, of course, the code you gave me doesn't actually do anything when run as a standalone Python program. I would like you to fix that.

I copied your PHP code to this file:

https://github.com/lukebakken/php-amqplib-1105/blob/main/php-repro/repro.php

...again, as provided, it doesn't do anything.

I will gladly cooperate with you in completing the reproduction code and then investigating the issue, but I'm going to need you to help out. Thanks.

[wiryonolau]

Hi you could ask it nicely.

Sometime you can find with just checking the config.

You can say config seems ok and we need to see all the source code. I'll try built the full source.

Thats why I put it in discussion instead as an issue, someone might already see the problem.

My php repo is at https://github.com/wiryonolau/php-queue

I haven't push the fix and change for tls. I'll update here when it is done.

[lukebakken]

Hi you could ask it nicely

I am being nice. If you think otherwise, spend some time on the LKML.

Thats wht I put it in discussion instead as an issue,

I converted your original issue, #1104, into this discussion (#1105).

You can say config seems ok and we need to see all the source code

I already did that, and the code you provided is not runnable.

At first glance, your PHP code looks correct. But, then you put it entirely on me and @ramunasd (the other project maintainer) to take the time to set everything up to see the same issue. It is courteous to do as much of that work as possible yourself so that we can spend time diagnosing and fixing the issue.

This doesn't apply to just php-amqplib but all of the vast amount of free software I'm certain you use every day.

[wiryonolau]

Hi I need time to prepare my code for share
Here is what I found.

$config = new AMQPConnectionConfig();

// This doesn't set the correct network protocol to ssl in AMQPConnectionFactory 
// PhpAmqpLib\Wire\IO\StreamIO will still use "tcp" if networkprotocol not set
$config->setIsSecure(true); 
// We need to manually set the network protocol too.
$config->setNetworkProtocol("ssl"); 

Still testing ssl
Setting setSslVerify false works normally as long the cert and ca cert is null

[wiryonolau]

Testing using ssl works ok, there is no option to allow_self_signed ssl context thought

[lukebakken]

Thank you very much for investigating. We would appreciate a pull request to set the correct network protocol when setIsSecure(true) is called.

[lukebakken]

@wiryonolau thank you SO MUCH for the pull request - #1106