Troubleshooting RabbitMQ TLS Handshake Failure (no_suitable_ciphers)

Products

• RabbitMQ

Issue/Introduction

When attempting to connect to a RabbitMQ instance over TLS/SSL (e.g., using the KingswaySoft SSIS connector, .NET clients, or OpenSSL), the connection fails during the handshake. The following errors appear in the RabbitMQ server logs:

• [notice] <0.x.0> TLS server: In state hello at tls_handshake.erl:xxx generated SERVER ALERT: Fatal - Insufficient Security
  
  
• [notice] <0.x.0> - no_suitable_ciphers
  
  
• [error] <0.x.0> {tls_alert,{insufficient_security, "..."}} error during handshake for protocol 'amqp/ssl'

Environment

Rabbitmq 4.2.x

Cause

This error occurs when the RabbitMQ server and the connecting client cannot agree on a common TLS version or Cipher Suite. Common triggers include:

1. Protocol Mismatch: The client is attempting to use an older protocol (like TLS 1.0 or 1.1) that is disabled on the server, or the server requires TLS 1.3 while the client only supports TLS 1.2.
   
   
2. Cipher Suite Mismatch: The server has a restricted list of hardened cipher suites, and the client's operating system (often Windows/Schannel) does not have a matching suite enabled or prioritized.
   
   
3. Index Overwrites: In RabbitMQ configuration, reusing indexes for ssl_options.ciphers can accidentally overwrite the supported list.

Resolution

1. Verify Enabled Protocols and Ciphers

On the RabbitMQ node, run the following diagnostic commands:

 

# Check supported TLS versionsrabbitmq-diagnostics tls_versions
# Check enabled cipher suites in OpenSSL formatrabbitmq-diagnostics cipher_suites --format openssl

 

2. Update RabbitMQ Configuration

Validate rabbitmq.conf to explicitly allow the TLS versions required by your clients. For most modern enterprise connectors, enabling TLS 1.2 and 1.3 is recommended:

 

 

3. Configure the Client Environment (Windows)

If the client is running on Windows (e.g., SSIS, .NET Core):

• Ensure TLS 1.2 is enabled in the Registry
  
  
• Use a tool like IIS Crypto to verify that the Cipher Suite order on the Windows machine matches at least one of the ciphers listed in the RabbitMQ diagnostics output.