TLS and mTLS
Securing the KubeMQ RabbitMQ connector — amqps on port 5671 via the server Security block, server-auth and mutual TLS, and encrypting the JWT in the password.
The KubeMQ RabbitMQ connector exposes a TLS/AMQPS listener on port 5671. TLS is not
AMQP-specific: it is governed by the server-global Security block, shared with the gRPC and
REST connectors. This guide documents server-auth TLS and mutual TLS (mTLS).
TLS is configured server-side from the top-level Security block (not from any AMQP-specific
field). The runnable examples use plain amqp:// against a stock dev broker; to use amqps://,
supply your own certificates and configure the Security block — see
Configuration. For the shared TLS/security model across
KubeMQ connectors, see Auth & security.
When TLS is active
The TLS listener (TlsPort, default 5671) is active only when the server-global Security
block is configured (Mode ≠ None). When it is active:
- TLS 1.2+ is enforced;
- the URL form is
amqps://<user>:<JWT>@host:5671/<vhost>; - mTLS (client certificates) is supported.
The plain listener (Port, default 5672) continues to work alongside the TLS listener.
export KUBEMQ_AMQP_URL="amqps://guest:guest@localhost:5671/"Why TLS matters here. The KubeMQ JWT travels in the SASL PLAIN password in cleartext at the AMQP layer. Without TLS the JWT is exposed on the wire. Production deployments that use authentication MUST use the 5671 TLS listener. See Authentication.
TLS (server authentication)
The client validates the server certificate against a trusted CA, then performs the normal SASL PLAIN handshake over the encrypted channel. The per-language idioms:
| Language | TLS entry point |
|---|---|
| Go | amqp.DialTLS(url, tlsConfig) |
| Python (pika) | pika.SSLOptions(ssl_context) |
| Java | factory.useSslProtocol(sslContext) |
| JavaScript (amqplib) | TLS options passed to connect(url, { ... }) |
| C# (.NET) | ConnectionFactory.Ssl = new SslOption { ... } |
| Ruby (bunny) | Bunny.new("amqps://…", tls: true, tls_ca_certificates: [...]) |
| Rust (lapin) | rustls / native-tls feature + TLS connection properties |
A server-auth TLS connection still authenticates separately at the SASL layer (PLAIN with the JWT in the password) — see Authentication.
mTLS (mutual authentication)
mTLS additionally presents a client certificate validated by the server's CA. Configure the
server-global Security block to require client certs, then supply the client cert / key / CA on
the connection:
amqps://<user>:<JWT>@host:5671/<vhost>
+ client certificate (cert + private key)
+ CA bundle that signed the server certificate
+ verify_peer = trueConfiguration
TLS is configured via the server-global Security block, not the AMQP config. The only
AMQP-specific knob is the listener port:
| Env var | Default | Effect |
|---|---|---|
CONNECTORS_AMQP_TLS_PORT | 5671 | TLS/AMQPS listener port; 0 disables TLS. |
See Configuration.
Related
Authentication
SASL PLAIN with the JWT in the password — the credential this TLS listener exists to protect.
Configuration
The Security block, CONNECTORS_AMQP_TLS_PORT, and the rest of the connector's server-side settings.
Auth & security
The shared TLS/mTLS and JWT security model across KubeMQ connectors.
Was this page helpful?