Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use the public_key:cacerts_get/0 function when appropriate #10519

Closed
lukebakken opened this issue Feb 8, 2024 · 4 comments
Closed

Use the public_key:cacerts_get/0 function when appropriate #10519

lukebakken opened this issue Feb 8, 2024 · 4 comments
Assignees
Milestone

Comments

@lukebakken
Copy link
Collaborator

lukebakken commented Feb 8, 2024

References:

API: https://www.erlang.org/doc/man/public_key#cacerts_get-0

Anywhere SSl/TLS is configured in RabbitMQ, if the user does not configure cacertfile or cacerts, RabbitMQ should automatically use public_key:cacerts_get/0 to load the system certificates.

If, after doing all of that, RabbitMQ could set verify to verify_none. Otherwise, the ssl functions will fail as reported in erlang/otp#8066

Note that I've never seen cacerts used in practice.

@michaelklishin
Copy link
Member

I don't think that we should widely fall back to verify_none. Certainly not for client connections. using public_key:cacerts_get/0 as a fallback is a good idea.

@LoisSotoLopez
Copy link
Contributor

We can work on implementing this one.

@michaelklishin
Copy link
Member

@LoisSotoLopez we'd appreciate it. We have seen a case where this behavior would be very useful just earlier this week.

@michaelklishin
Copy link
Member

#12557 #12564.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants