Updating Ciphers in Pre-provisioned RabbitMQ on TAS

Products

• VMware Tanzu RabbitMQ

Issue/Introduction

How do you add new SSL ciphers to a pre-provisioned RabbitMQ ensuring that it persists across stemcell updates, VM re-creation and service instance deployments? Would adding new cipher suites manually to 11-tlsConfig.conf work?

Environment

All Pre-Provisioned RabbitMQ offerings on Tanzu Application Service (TAS)

Cause

Adding new cipher suites manually to 11-tlsConfig.conf will not persist across VM recreations, stemcell upgrades and service deployments. To have it persist, you need to override it via the 'Expert Mode' in the RabbitMQ Tile. There is also a limitation in the pre-provisioned service offering which only supports the older Erlang-style format of override configuration. 

Resolution

First, create an advanced.config file with the correct ssl configuration and generate the base64 encoded value from this.

Since the advanced.config file includes multiple lines, you will need to disable line wrapping during base64 encoding so the output is generated as a single contiguous string for the tile UI to ingest cleanly. You must also include the complete ssl_options tuple (including certificate paths and all desired ciphers), as this configuration will override rather than merge with the default ssl_options in 11-tlsConfig.conf.

See example below. 

cat << 'EOF' > /tmp/advanced.config
[
{rabbit, [
{ssl_options, [
{cacertfile, "/var/vcap/jobs/rabbitmq-server/etc/cacert.pem"},
{certfile, "/var/vcap/jobs/rabbitmq-server/etc/cert.pem"},
{keyfile, "/var/vcap/jobs/rabbitmq-server/etc/key.pem"},
{fail_if_no_peer_cert, false},
{verify, verify_peer},
{versions, ['tlsv1.3', 'tlsv1.2']},
{ciphers, [
"TLS_AES_256_GCM_SHA384",
"TLS_AES_128_GCM_SHA256",
"TLS_CHACHA20_POLY1305_SHA256",
"ECDHE-ECDSA-AES256-GCM-SHA384",
"ECDHE-RSA-AES256-GCM-SHA384",
"ECDHE-ECDSA-CHACHA20-POLY1305",
"ECDHE-RSA-CHACHA20-POLY1305",
"ECDHE-ECDSA-AES128-GCM-SHA256",
"ECDHE-RSA-AES128-GCM-SHA256",
"DHE-RSA-AES256-GCM-SHA384",
"DHE-RSA-AES128-GCM-SHA256"
]}
]}
]}
].
EOF

Encode cleanly as a single contiguous string:

On Ubuntu /Linux :

base64 -w 0 /tmp/advanced.config

On macOS:

base64 -i /tmp/advanced.config