---
title: "Preparing AMQP 0.9.1 TLS connections for the upgrade to 26.4.0"
slug: "amqp-0-9-1-tls-hostname-verification"
status: "new"
updated: 2026-10-27T09:03:09Z
published: 2026-10-27T09:03:09Z
canonical: "docs.lobstersoftware.com/amqp-0-9-1-tls-hostname-verification"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lobstersoftware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Preparing AMQP 0.9.1 TLS connections for the upgrade to 26.4.0

Starting with version 26.4.0 of the **Lobster Data Platform**, the behavior of TLS connections for legacy AMQP connections has changed (see [AMQP connections (Legacy)](/v1/docs/en/manage-amqp)). The connection now checks whether the broker's certificate matches the configured host. Previously, it only checked the certificate's chain of trust.

## What has changed

In version 26.4.0, the underlying RabbitMQ client library was updated from version 5.25.0 to 5.35.0. The update addresses several security vulnerabilities, including pre-authentication denial-of-service vulnerabilities.

As a result, TLS connections using AMQP 0.9.1 now verify the broker's hostname. The hostname in the certificate must match the configured host.

## Who is affected?

You are affected if all three points apply:

1. You are using a legacy AMQP connection with AMQP 0.9.1 (see [AMQP connections (Legacy)](/v1/docs/en/manage-amqp)).
2. TLS is enabled for the connection (the **Is an SSL connection** checkbox is selected).
3. A **certificate** or a keystore with a **passphrase for the SSL keystore** has been stored.

You are not affected if any of the following apply:

- The connection does not use SSL.
- The CN or SAN of the broker certificate already matches the host configured in the connection.
- You are using a channel-based AMQP connection (configured via a Channel). Hostname verification is already enabled there.

## When do connections fail?

After the upgrade, a connection will fail if the broker certificate does not match the configured host. Common scenarios:

- The connection is configured with an IP address, but the certificate contains a DNS name.
- A short internal hostname is used, but the certificate contains a fully qualified domain name (FQDN).
- A Self-signed certificate was created with a placeholder or a different name.

## What you should do before upgrading to 26.4.0

1. Identify all legacy AMQP connections using AMQP 0.9.1 for which TLS is enabled (the **Is an SSL connection** checkbox is selected) and for which a certificate or a keystore with a passphrase has been configured.
2. Verify that the CN or SAN of the broker certificate exactly matches the host configured in the connection.
3. Resolve a discrepancy in one of two ways:
  - Reissue the broker certificate with the correct host or SAN.
  - Change the connection so that the host matches the certificate.

If you are unsure whether your configuration is affected, please contact Support before upgrading.

Acronym for **Advanced Message Queuing Protocol**. Open protocol for message-based middleware that enables reliable, asynchronous data exchange across message queues and topics. Available in the Lobster Data Platform as an AMQP ingress agent and response. The requirement is an existing AMQP server.

A central data record in partner management that consolidates the connection parameters for a communication partner, such as the URL, access credentials, and protocol. Changes to a channel immediately affect all profiles, ASM entries, and content inspection entries that use that channel.

**DNS (Domain Name System)** translates names such as your-company.lobster-cloud.com into IP addresses, so a Lobster Cloud system can be reached by a fixed name rather than a changing IP address. Every system is assigned such names automatically during installation. Because the IP can change, for example, after a recovery, while the name stays the same, the name is the reliable address for integrations.

A self-signed certificate is a certificate signed by its owner rather than by a certificate authority. For AS2, this is usually sufficient because both sides exchange certificates directly. Self-signed certificates can be created within the Lobster Data Platform.

## Related

- [AMQP connections (Legacy)](/manage-amqp.md)