我目前正在设置一个RabbitMQ集群，要求集群内的所有通信都要encryption。
我按照https://www.rabbitmq.com/clustering-ssl.html上的指南 – 使用cert和key创build了一个文件，并将SSL参数作为环境variables传递给rabbitmq-server：
RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS='-pa /usr/lib/erlang/lib/ssl-7.1/ebin -proto_dist inet_tls -ssl_dist_opt server_certfile /etc/ssl/certs/rabbit.pem' RABBITMQ_CTL_ERL_ARGS='-pa /usr/lib/erlang/lib/ssl-7.1/ebin -proto_dist inet_tls -ssl_dist_opt server_certfile /etc/ssl/certs/rabbit.pem' 服务器启动正常，并启用TLS侦听，但我不能通过rabbitmqctl发出任何命令：
# rabbitmqctl status Status of node rabbit@rabbit01 ... Error: unable to connect to node rabbit@rabbit01: nodedown DIAGNOSTICS =========== attempted to contact: [rabbit@rabbit01] rabbit@rabbit01: * connected to epmd (port 4369) on rabbit01 * epmd reports node 'rabbit' running on port 47965 * TCP connection succeeded but Erlang distribution failed * suggestion: hostname mismatch? * suggestion: is the cookie set correctly? * suggestion: is the Erlang distribution using TLS?
在服务器方面，除了彻底的无用之外，我没有在日志中得到任何东西：
=ERROR REPORT==== 30-Dec-2015::13:08:58 === SSL: hello: tls_handshake.erl:167:Fatal error: insufficient security
有一点四处search表明，这可能是由于密码套件不匹配，但我的理解是，他们都将使用相同的SSL库。
Erlang会费已启用SSL支持，如https://www.rabbitmq.com/troubleshooting-ssl.html上所检查的，我可以使用openssl的s_server和s_client与证书build立安全连接。
我不知道下一步是怎么解决这个问题的，在集群的任何地方都找不到任何已知的问题 – 不幸的是，大多数关于TLS的RabbitMQ文档是针对AMQP协议的，而不是针对内部集群的。
我已经testing了使用openSSL连接到正在运行的RabbitMQ实例，并得到一个非常类似的错误：
# openssl s_client -connect localhost:47965 CONNECTED(00000003) 140004605863584:error:1407742F:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert insufficient security:s23_clnt.c:770: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 295 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE --- openssl s_client -connect localhost:47965 -tls1_2 CONNECTED(00000003) 140400037775008:error:1409442F:SSL routines:SSL3_READ_BYTES:tlsv1 alert insufficient security:s3_pkt.c:1262:SSL alert number 71 140400037775008:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:598: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1451944018 Timeout : 7200 (sec) Verify return code: 0 (ok) ---