SSL RabbitMQ server and client configuration
<p>I have been setting up a RabbitMQ server on development machine to listen for TLS/SSL connections, port 5671, according to documentation on: <a href="https://www.rabbitmq.com/ssl.html" rel="nofollow">https://www.rabbitmq.com/ssl.html</a></p>

<p>An AMQP client for publishing over SSL secured connection uses videlalvaro/php-amqplib library, version 2.6.0.</p>

<p>I created SSL certificate authority and certificates for both server and client, as described in the documentation. </p>

<pre><code># mkdir testca
# cd testca
# mkdir certs private
...
</code></pre>

<p>Then created the openssl.cnf with proposed contents,
and ran the listed openssl commands for openssl.cnf file, client and server directories.</p>

<p>After that I enabled RabbitMQ SSL support and verified in log that it's listening:</p>

<pre><code>=INFO REPORT==== 9-Feb-2016::14:02:41 ===
started SSL Listener on 127.0.0.1:5671
</code></pre>

<p>I also implemented the SSL on client side, and it is all working. </p>

<pre><code>=INFO REPORT==== 9-Feb-2016::14:09:48 ===
accepting AMQP connection &lt;0.4285.0&gt; (127.0.0.1:28876 -&gt; 127.0.0.1:5671)
</code></pre>

<p>The server and client are on the same, development machine.</p>

<p>The part that I don't quite understand is about SSL authority and certificates.</p>

<p>Both server and client in development are using the same ~/testca/cacert.pem file.</p>

<p>RabbitMQ config:</p>

<pre><code>{cacertfile,"/home/me/testca/cacert.pem"},
{certfile,"/home/me/server/cert.pem"},
{keyfile,"/home/me/server/key.pem"},
</code></pre>

<p>Client's AMQPSSLConnection parameter:</p>

<pre><code>$sslOptions = array(
'cafile' =&gt; '/home/me/testca/cacert.pem',
'local_cert' =&gt; '/home/me/client/key-cert.pem',
'peer_name'=&gt;'me-OptiPlex-790',
'verify_peer_name' =&gt; true
);
</code></pre>

<p>On a production, the server and client are of course on different, remote machines.</p>

<p>So, how do I proceed now?</p>

<p>I suppose I should follow the same procedure on RabbitMQ production
   machine?</p>

<p>That is, create openssl.cnf file with some actual data and
   generate the key and certificates for server?</p>

<p>And then do the same on a client machine, for the client?</p>

<p>So the server and client would have separate
   openssl.cnf and .../testca/cacert.pem files, along with their own
   cert and key files?</p>

<p>Would the SSL connection work in that manner?</p>