tlsv1 alert insufficient security with rabbitmq

Question

Tried with management console with both openssl and browser after enable ssl with rabbitMq 3.4.3.1 (Erlang 17.1)

Got this insufficient security issue. I guess something issue with erlang accepted ciphers for negotiation?

Anyone see this?

Answer 1

My problem with same appearance was in x509 keyUsage certificate extension. Documentation "highly recommends" to use both digitalSignature and keyEncipherment, but in practice rabbitmq (3.7.18) won't work with RSA certificate specifying only keyUsage=keyEncipherment. You have to either omit keyUsage or add digitalSignature.

Answer 2

Indeed certificate key usage extensions can also be the root cause. RabbitMQ documentation now has note about this [1].

1. https://www.rabbitmq.com/ssl.html#key-usage