RabbitMQ 3.8.17 - Failed to enable rabbitmq_management

[sanjeethmallesh]

Having tough time enabling rabbitmq_management using 3.8.17

Platform: CentOS7
Rabbitmq: rabbitmq-server-3.8.17-1.el7.noarch.rpm
Erlang: erlang-23.2.7-1.el7.x86_64.rpm

[node]# rabbitmq-plugins enable rabbitmq_management
Enabling plugins on node rabbit@9beb1792-bb14-4beb-a95a-280d556d32df:
rabbitmq_management
The following plugins have been configured:
  rabbitmq_management
  rabbitmq_management_agent
  rabbitmq_web_dispatch
Applying plugin configuration to rabbit@9beb1792-bb14-4beb-a95a-280d556d32df...
Stack trace:

** (CaseClauseError) no case clause matching: {:could_not_start, :rabbitmq_management, {:rabbitmq_management, {:bad_return, {{:rabbit_mgmt_app, :start, [:normal, []]}, {:EXIT, {{:could_not_start_listener, [cowboy_opts: [sendfile: false], port: 15671, ssl: true, ssl_opts: [cacertfile: '/etc/rabbitmq/ssl/truststore.pem', certfile: '/etc/rabbitmq/ssl/server/cert.pem', keyfile: '/etc/rabbitmq/ssl/server/key.pem', verify: :verify_peer, honor_cipher_order: true, honor_ecc_order: true, client_renegotiation: false, secure_renegotiate: true, fail_if_no_peer_cert: false, ciphers: ['ECDHE-RSA-AES128-GCM-SHA256', 'DHE-RSA-AES128-GCM-SHA256'], versions: [:"tlsv1.3", :"tlsv1.2"]]], {:shutdown, {:failed_to_start_child, {:ranch_listener_sup, {:acceptor, {0, 0, 0, 0, 0, 0, 0, 0}, 15671}}, {:shutdown, {:failed_to_start_child, :ranch_acceptors_sup, {:listen_error, {:acceptor, {0, 0, 0, 0, 0, 0, 0, 0}, 15671}, {:options, {:insufficient_crypto_support, {:"tlsv1.3", {:versions, [:"tlsv1.3", :"tlsv1.2"]}}}}}}}}}}, {:gen_server, :call, [:rabbit_web_dispatch_registry, {:add, :rabbitmq_management_tls, [cowboy_opts: [sendfile: false], port: 15671, ssl: true, ssl_opts: [cacertfile: '/etc/rabbitmq/ssl/truststore.pem', certfile: '/etc/rabbitmq/ssl/server/cert.pem', keyfile: '/etc/rabbitmq/ssl/server/key.pem', verify: :verify_peer, honor_cipher_order: true, honor_ecc_order: true, client_renegotiation: false, secure_renegotiate: true, fail_if_no_peer_cert: false, ciphers: ['ECDHE-RSA-AES128-GCM-SHA256', 'DHE-RSA-AES128-GCM-SHA256'], versions: [:"tlsv1.3", :"tlsv1.2"]]], #Function<0.59200757/1 in :rabbit_web_dispatch>, [{:_, [], [{[], [], :rabbit_mgmt_wm_static, {:priv_file, :rabbitmq_management, 'www/index.html'}}, {["api", "overview"], [], :rabbit_mgmt_wm_overview, []}, {["api", "cluster-name"], [], :rabbit_mgmt_wm_cluster_name, []}, {["api", "nodes"], [], :rabbit_mgmt_wm_nodes, []}, {["api", "nodes", :node], [], :rabbit_mgmt_wm_node, []}, {["api", "nodes", :node, "memory"], [], :rabbit_mgmt_wm_node_memory, [:absolute]}, {["api", "nodes", :node, "memory", "relative"], [], :rabbit_mgmt_wm_node_memory, [:relative]}, {["api", "nodes", :node, "memory", "ets"], [], :rabbit_mgmt_wm_node_memory_ets, [:absolute]}, {["api", "nodes", :node, "memory", "ets", "relative"], [], :rabbit_mgmt_wm_node_memory_ets, [:relative]}, {["api", "nodes", :node, "memory", "ets", :filter], [], :rabbit_mgmt_wm_node_memory_ets, [:absolute]}, {["api", "nodes", :node, "memory", "ets", :filter, "relative"], [], :rabbit_mgmt_wm_node_memory_ets, [:relative]}, {["api", "extensions"], [], :rabbit_mgmt_wm_extensions, []}, {["api", "all-configuration"], [], :rabbit_mgmt_wm_definitions, []}, {["api", "definitions"], [], :rabbit_mgmt_wm_definitions, []}, {["api", "definitions", :vhost], [], :rabbit_mgmt_wm_definitions, []}, {["api", "parameters"], [], :rabbit_mgmt_wm_parameters, []}, {["api", "parameters", :component], [], :rabbit_mgmt_wm_parameters, []}, {["api", "parameters", :component, :vhost], [], :rabbit_mgmt_wm_parameters, []}, {["api", "parameters", :component, ...], [], :rabbit_mgmt_wm_parameter, []}, {["api", "global-parameters"], [], :rabbit_mgmt_wm_global_parameters, ...}, {["api", ...], [], ...}, {[...], ...}, {...}, ...]}], {[], 'RabbitMQ Management'}}, :infinity]}}}}}}}
    (rabbitmqctl 3.8.0-dev) lib/rabbitmq/cli/plugins/plugins_helpers.ex:210: RabbitMQ.CLI.Plugins.Helpers.update_enabled_plugins/2
    (rabbitmqctl 3.8.0-dev) lib/rabbitmq/cli/plugins/plugins_helpers.ex:107: RabbitMQ.CLI.Plugins.Helpers.update_enabled_plugins/4
    (rabbitmqctl 3.8.0-dev) lib/rabbitmq/cli/plugins/commands/enable_command.ex:121: anonymous fn/6 in RabbitMQ.CLI.Plugins.Commands.EnableCommand.do_run/2
    (elixir 1.10.4) lib/stream.ex:1325: anonymous fn/2 in Stream.iterate/2
    (elixir 1.10.4) lib/stream.ex:1538: Stream.do_unfold/4
    (elixir 1.10.4) lib/stream.ex:1609: Enumerable.Stream.do_each/4
    (elixir 1.10.4) lib/stream.ex:956: Stream.do_enum_transform/7
    (elixir 1.10.4) lib/stream.ex:1609: Enumerable.Stream.do_each/4

[lhoguin]

They key part in the error is {:options, {:insufficient_crypto_support, {:"tlsv1.3", {:versions, [:"tlsv1.3", :"tlsv1.2"]}}}}. Make sure the crypto application is available and that the ciphers required for TLS1.3 are available, or disable TLS1.3.

[sanjeethmallesh]

Thanks for your response @lhoguin

On the other stack we are using TLS1.3 & TLS1.2 for rabbitmq-sever-3.8.9-1 with erlang-23.1.5 and the enabling rabbitmq_management has not been problem.

{rabbitmq_management, [
    {listener, [
      {ssl, true},
      {ssl_opts, [
        {cacertfile,           "/etc/rabbitmq/ssl/truststore.pem"},
        {certfile,             "/etc/rabbitmq/ssl/server/cert.pem"},
        {keyfile,              "/etc/rabbitmq/ssl/server/key.pem"},
        {verify,               verify_peer},
        {honor_cipher_order,   true},
        {honor_ecc_order,      true},
        {client_renegotiation, false},
        {secure_renegotiate,   true},
        {fail_if_no_peer_cert, false},
        {ciphers,              [
          "CIFER1", "CIFER2"
        ]},
        %% Restrict available versions of SSL/TLS for security
        {versions, ['tlsv1.3', 'tlsv1.2']}
      ]},
      {port, 15671}
    ]}
  ]}

[lhoguin]

It is not an issue with RabbitMQ in any case. RabbitMQ just defers to Erlang/OTP, and the error comes from inside the TLS implementation from Erlang/OTP. So something related to the Erlang/OTP version you have installed is causing you this issue. Note that TLS 1.3 was and is still fairly new in Erlang/OTP and has not been battle tested all that much yet so there could be relatively important differences between Erlang/OTP versions as the implementation improves.

[lhoguin]

The most recent 23 version of OTP is 23.3.4.4. If there was an issue in 23.2.7 it is most likely long gone now.

[sanjeethmallesh]

@lhoguin will check upgrading Elrang package.. Thanks!

[sanjeethmallesh]

Thank you, moving the investigation with erlang package