RabbitMQ: SSL password encryption support for plugins in rabbitmq.conf

Products

• VMware Tanzu Data Suite
• RabbitMQ
• VMware Tanzu RabbitMQ
• Support Only for OpenSource RabbitMQ

Issue/Introduction

Recent enhancements in RabbitMQ address the requirement for password and secret encryption across all major RabbitMQ plugins using rabbitmq.conf. Previously, several plugins required legacy configuration formats (using advanced.config) as described in this example, which many users found cumbersome.

These enhancements have expanded native encrypted value support to include password, private key, and secret fields for additional components including rabbitmq_management, rabbitmq_prometheus, and rabbitmq_web_stomp. 

Environment

Release Details & Availability

• Supported Versions: The changes are backported across all active release lines. The initial release round including these changes consists of:

  • 3.13.x (Up to 3.13.17)

  • 4.1.x (Up to 4.1.13)

  • 4.2.x (Up to 4.2.8)

  • 4.3.x (Up to 4.3.2)

Resolution

Supported Encrypted Keys Matrix

 

Component / Plugin	Supported Configuration Keys for Encryption
Core RabbitMQ	default_pass default_users.$name.password anonymous_login_pass definitions.tls.password log.syslog.ssl_options.password amqp_client.ssl_options.password amqp10_client.ssl_options.password Partial templates (e.g., auth_ldap, cluster_formation.consul, cluster_formation.etcd, auth_http, trust_store SSL passwords)
Management	management.listener.ssl_opts.password management.ssl.password management.oauth_client_secret management.oauth_resource_servers.$name.oauth_client_secret
LDAP	auth_ldap.dn_lookup_bind.password auth_ldap.other_bind.password auth_ldap.ssl_options.password
Peer Discovery	cluster_formation.aws.secret_key cluster_formation.consul.acl_token cluster_formation.etcd.password (SSL options passwords for Consul/Etcd via core partials)
Protocol & Other Plugins	stomp.default_pass tracing.password web_stomp.ssl.password web_mqtt.ssl.password prometheus.ssl.password (Note: Uses tagged_string, whereas other SSL parameters utilize tagged_binary)

Known Gaps & Limitations

• definitions.https.url: This key does not currently support encrypted values and represents the sole outstanding gap.

The fix will be available in future releases of RabbitMQ. Please subscribe to this article for the fix availability.

Additional Information

Reference Pull Requests:

• PR #16516

• PR #15808 (Covers the majority of password and private key fields)

• PR #16632 (Addresses remaining encryption support gaps)