Preparing AMQP 0.9.1 TLS connections for the upgrade to 26.4.0

Prev Next

Starting with version 26.4.0 of the Lobster Data Platform, the behavior of TLS connections for legacy AMQP connections has changed (see AMQP connections (Legacy)). The connection now checks whether the broker's certificate matches the configured host. Previously, it only checked the certificate's chain of trust.

What has changed

In version 26.4.0, the underlying RabbitMQ client library was updated from version 5.25.0 to 5.35.0. The update addresses several security vulnerabilities, including pre-authentication denial-of-service vulnerabilities.

As a result, TLS connections using AMQP 0.9.1 now verify the broker's hostname. The hostname in the certificate must match the configured host.

Who is affected?

You are affected if all three points apply:

  1. You are using a legacy AMQP connection with AMQP 0.9.1 (see AMQP connections (Legacy)).

  2. TLS is enabled for the connection (the Is an SSL connection checkbox is selected).

  3. A certificate or a keystore with a passphrase for the SSL keystore has been stored.

You are not affected if any of the following apply:

  • The connection does not use SSL.

  • The CN or SAN of the broker certificate already matches the host configured in the connection.

  • You are using a channel-based AMQP connection (configured via a Channel). Hostname verification is already enabled there.

When do connections fail?

After the upgrade, a connection will fail if the broker certificate does not match the configured host. Common scenarios:

  • The connection is configured with an IP address, but the certificate contains a DNS name.

  • A short internal hostname is used, but the certificate contains a fully qualified domain name (FQDN).

  • A Self-signed certificate was created with a placeholder or a different name.

What you should do before upgrading to 26.4.0

  1. Identify all legacy AMQP connections using AMQP 0.9.1 for which TLS is enabled (the Is an SSL connection checkbox is selected) and for which a certificate or a keystore with a passphrase has been configured.

  2. Verify that the CN or SAN of the broker certificate exactly matches the host configured in the connection.

  3. Resolve a discrepancy in one of two ways:

    • Reissue the broker certificate with the correct host or SAN.

    • Change the connection so that the host matches the certificate.

If you are unsure whether your configuration is affected, please contact Support before upgrading.

Related articles