Home/Learn/RabbitMQ/TLS & Authentication

TLS & Authentication

Intermediate

Operations

Enable TLS for encrypted transport and client-certificate authentication; LDAP or OAuth2 backend plugins handle centralised user management beyond local user accounts.

Overview

By default RabbitMQ communicates in plaintext, making it unsuitable for production without TLS. TLS (AMQPS on port 5671, HTTPS management on 15671) encrypts data in transit and optionally authenticates clients via mutual TLS (mTLS). For centralised user management, RabbitMQ supports pluggable auth backends: rabbitmq-auth-backend-ldap (directory services), rabbitmq-auth-backend-oauth2 (JWT/OIDC), and the built-in internal database. OAuth2/JWT is the modern approach for Kubernetes and cloud-native deployments.

Enabling TLS on the Broker

Generate a CA, server certificate, and optionally client certificates. Configure rabbitmq.conf to listen on AMQPS port 5671 and point to the certificate files.

rabbitmq.conf — TLS configuration

# rabbitmq.conf — enable TLS
listeners.ssl.default = 5671

ssl_options.cacertfile = /etc/rabbitmq/certs/ca_certificate.pem
ssl_options.certfile   = /etc/rabbitmq/certs/server_certificate.pem
ssl_options.keyfile    = /etc/rabbitmq/certs/server_key.pem
ssl_options.verify     = verify_peer          # verify client cert (mTLS)
ssl_options.fail_if_no_peer_cert = true       # require client cert

# TLS version and cipher restrictions
ssl_options.versions.1 = tlsv1.2
ssl_options.versions.2 = tlsv1.3

# Disable plaintext AMQP (optional — forces all traffic through TLS)
listeners.tcp = none

# Management plugin TLS
management.ssl.port       = 15671
management.ssl.cacertfile = /etc/rabbitmq/certs/ca_certificate.pem
management.ssl.certfile   = /etc/rabbitmq/certs/server_certificate.pem
management.ssl.keyfile    = /etc/rabbitmq/certs/server_key.pem

Spring AMQP with TLS (Client Side)

Configure the Spring CachingConnectionFactory to use TLS by providing truststore and optionally keystore (for mTLS). The amqp-client's SSLContext is set on the underlying connection factory.

Java — Spring AMQP with mTLS

@Configuration
public class RabbitTlsConfig {

    @Bean
    public CachingConnectionFactory connectionFactory() throws Exception {
        com.rabbitmq.client.ConnectionFactory rabbitCf =
            new com.rabbitmq.client.ConnectionFactory();

        rabbitCf.setHost("rabbitmq.prod.internal");
        rabbitCf.setPort(5671);   // AMQPS

        // Load trust store (CA cert to verify broker)
        KeyStore trustStore = KeyStore.getInstance("JKS");
        try (InputStream is = new FileInputStream("/certs/truststore.jks")) {
            trustStore.load(is, "changeit".toCharArray());
        }
        TrustManagerFactory tmf = TrustManagerFactory
            .getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(trustStore);

        // mTLS — load client key store
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        try (InputStream is = new FileInputStream("/certs/client.p12")) {
            keyStore.load(is, "clientpass".toCharArray());
        }
        KeyManagerFactory kmf = KeyManagerFactory
            .getInstance(KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(keyStore, "clientpass".toCharArray());

        SSLContext ctx = SSLContext.getInstance("TLSv1.3");
        ctx.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

        rabbitCf.useSslProtocol(ctx);
        return new CachingConnectionFactory(rabbitCf);
    }
}

OAuth2 / JWT Authentication

The rabbitmq-auth-backend-oauth2 plugin validates JWT tokens (e.g. from Keycloak or Auth0) for both AMQP and HTTP management. Scopes map to RabbitMQ permissions. This is ideal for service accounts in Kubernetes (IRSA, Workload Identity).

rabbitmq.conf + Properties — OAuth2 authentication

# rabbitmq.conf — OAuth2 plugin
auth_backends.1 = rabbit_auth_backend_oauth2

auth_oauth2.resource_server_id = my-rabbitmq
auth_oauth2.jwks_url = https://keycloak.example.com/realms/prod/protocol/openid-connect/certs
auth_oauth2.issuer   = https://keycloak.example.com/realms/prod

# JWT claim → permission mapping
# scope "rabbitmq.read:shop/orders.*"  → read permission on vhost "shop", topic "orders.*"
# scope "rabbitmq.write:shop/*"        → write permission on all queues in vhost "shop"
# scope "rabbitmq.configure:shop/*"    → configure permission

# Spring Boot — use token as password
spring.rabbitmq.username=my-service-account    # token subject
spring.rabbitmq.password=${ACCESS_TOKEN}       # JWT bearer token
spring.rabbitmq.virtual-host=shop

Key Points to Remember

1AMQPS listens on port 5671 (TLS); AMQP on 5672 (plaintext) — disable plaintext in production.
2ssl_options.verify=verify_peer + fail_if_no_peer_cert=true enables mutual TLS (mTLS).
3Spring AMQP mTLS requires a KeyManagerFactory (client cert) and TrustManagerFactory (CA cert).
4rabbitmq-auth-backend-oauth2 validates JWT tokens from any OIDC-compliant provider.
5JWT scopes map to RabbitMQ read/write/configure permissions per vhost and resource pattern.
6Use OAuth2 token auth for Kubernetes service accounts — no static passwords in secrets.

Interview Questions

What port does RabbitMQ use for AMQPS (TLS) connections?

EasyPivotal

What is mutual TLS (mTLS) and how does it differ from one-way TLS?

MediumAmazon

How does the rabbitmq-auth-backend-oauth2 plugin map JWT scopes to permissions?

HardNetflix

How would you configure Spring AMQP to use a TLS-secured RabbitMQ broker?

MediumInfosys

What are the advantages of OAuth2/JWT authentication over local RabbitMQ user accounts?

MediumRevolut

Ask Aria about TLS & Authentication

Your personal AI tutor — ask anything about this concept

Revision Status

Personal Notes

Discussion

Loading discussion…

High Availability

Permissions & Access Control