neutorn-server连接rabbitmq时提示CERTIFICATE_VERIFY_FAILED

【缺陷描述】：rabbitmq配置了自签名证书后，neutron-server连接rabbitmq时提示CERTIFICATE_VERIFY_FAILED

一、缺陷信息**

【缺陷所属的os版本】
NAME="openEuler"
VERSION="22.03 (LTS-SP2)"
ID="openEuler"
VERSION_ID="22.03"
PRETTY_NAME="openEuler 22.03 (LTS-SP2)"
ANSI_COLOR="0;31"

【内核版本】
5.10.0-153.56.0.134.oe2203sp2.x86_64

缺陷所属软件及版本号】
erlang-kernel-23.3.4.9-4.oe2203sp2.x86_64
kernel-5.10.0-153.56.0.134.oe2203sp2.x86_64
kernel-5.10.0-153.12.0.92.oe2203sp2.x86_64
kernel-tools-5.10.0-153.56.0.134.oe2203sp2.x86_64
kernel-headers-5.10.0-153.56.0.134.oe2203sp2.x86_64
kernel-devel-5.10.0-153.56.0.134.oe2203sp2.x86_64

【环境信息】
本地vmware虚拟机搭建的openstack环境

**【问题复现步骤】：

默认情况下，安装完rabbitmq的rpm包后，/etc/rabbitmq/目录下只有rabbitmq.conf文件

这是/etc/neutron/neutron.conf文件里面的rabbitmq信息
transport_url = rabbit://neutron:panyun@123@controller:5671//neutron

基于上面的配置，neutron-server连接rabbitmq-server没有问题

然后现在想使用ssl自签名证书，下面是使用自签名证书的配置：
配置/etc/neutron/neutron.conf文件的rabbitmq信息
transport_url = rabbit://neutron:panyun@123@controller:5671//neutron?ssl=1

配置/etc/rabbitmq/rabbitmq.config的内容如下
[
  {rabbit, [
    {loopback_users, []},
        {ssl_listeners, [{"192.168.84.138", 5671}]},
    {collect_statistics_interval, 5000 },
    {ssl_options, [{certfile,"/etc/rabbitmq/rabbitmq.pem"},
                   {keyfile,"/etc/rabbitmq/rabbitmq.key"},
                   {versions, ['tlsv1.2', 'tlsv1.1']},
                   {verify,verify_none},
                   {fail_if_no_peer_cert,false}]}
    ,{cluster_partition_handling, pause_minority}      ]},
  {log_levels, [{connection,debug},{channel,debug},{exchange,debug}]},
  {rabbitmq_management, [{listener, [{port, 15672}, {ip, "192.168.84.138"}]}, {rates_mode, basic }] }
].

【实际结果】
neutron-server启动后连接rabbitmq-server时提示
2024-11-01 14:46:16.566 6 ERROR oslo.messaging._drivers.impl_rabbit [req-53e06bd2-4594-45c3-aea4-ecb4a29ccea9 - - - - -] Connection failed: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1129) (retrying in 18.0 seconds): ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1129)

而rabbitmq-server的日志提示
2024-11-01 14:46:18.751746+08:00 [notice] <0.21794.36> TLS server: In state certify received CLIENT ALERT: Fatal - Unknown CA

openEuler/openstack

内容风险标识

评论 (1)

openEuler/openstack .gitee-modal { width: 500px !important; }

内容风险标识