如何使用 SSL 将芹菜连接到 rabbitMQ

Question

我正在尝试使用 SSL 证书将芹菜与 rabbitMQ 代理连接起来。

这是代码：

from celery import Celery
import ssl
broker_uri = 'amqp://user:pwd@server:5672/vhost'
certs_conf = {
    "ca_certs": "/certs/serverca/cacert.pem",
    "certfile": "/certs/client/rabbit-cert.pem",
    "keyfile": "/certs/client/rabbit-key.pem",
    "cert_reqs": ssl.CERT_REQUIRED
}
app = Celery('tasks', broker=broker_uri)
app.conf.update(BROKER_USE_SSL=certs_conf)
app.send_task('task.name', [{'a': 1}])

当我尝试执行此代码时，出现以下异常：

Traceback (most recent call last):
  File "C:Python36libsite-packageskombuutilsfunctional.py", line 36, in __call__
    return self.__value__
AttributeError: 'ChannelPromise' object has no attribute '__value__'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "test_send_task.py", line 44, in <module>
    app.send_task('task.name', [message])
  File "C:Python36libsite-packagesceleryappbase.py", line 737, in send_task
    amqp.send_task_message(P, name, message, **options)
  File "C:Python36libsite-packagesceleryappamqp.py", line 558, in send_task_message
    **properties
  File "C:Python36libsite-packageskombumessaging.py", line 181, in publish
    exchange_name, declare,
  File "C:Python36libsite-packageskombuconnection.py", line 494, in _ensured
    return fun(*args, **kwargs)
  File "C:Python36libsite-packageskombumessaging.py", line 187, in _publish
    channel = self.channel
  File "C:Python36libsite-packageskombumessaging.py", line 209, in _get_channel
    channel = self._channel = channel()
  File "C:Python36libsite-packageskombuutilsfunctional.py", line 38, in __call__
    value = self.__value__ = self.__contract__()
  File "C:Python36libsite-packageskombumessaging.py", line 224, in <lambda>
    channel = ChannelPromise(lambda: connection.default_channel)
  File "C:Python36libsite-packageskombuconnection.py", line 819, in default_channel
    self.ensure_connection()
  File "C:Python36libsite-packageskombuconnection.py", line 405, in ensure_connection
    callback)
  File "C:Python36libsite-packageskombuutilsfunctional.py", line 333, in retry_over_time
    return fun(*args, **kwargs)
  File "C:Python36libsite-packageskombuconnection.py", line 261, in connect
    return self.connection
  File "C:Python36libsite-packageskombuconnection.py", line 802, in connection
    self._connection = self._establish_connection()
  File "C:Python36libsite-packageskombuconnection.py", line 757, in _establish_connection
    conn = self.transport.establish_connection()
  File "C:Python36libsite-packageskombutransportpyamqp.py", line 130, in establish_connection
    conn.connect()
  File "C:Python36libsite-packagesamqpconnection.py", line 288, in connect
    self.drain_events(timeout=self.connect_timeout)
  File "C:Python36libsite-packagesamqpconnection.py", line 471, in drain_events
    while not self.blocking_read(timeout):
  File "C:Python36libsite-packagesamqpconnection.py", line 477, in blocking_read
    return self.on_inbound_frame(frame)
  File "C:Python36libsite-packagesamqpmethod_framing.py", line 55, in on_frame
    callback(channel, method_sig, buf, None)
  File "C:Python36libsite-packagesamqpconnection.py", line 481, in on_inbound_method
    method_sig, payload, content,
  File "C:Python36libsite-packagesamqpabstract_channel.py", line 128, in dispatch_method
    listener(*args)
  File "C:Python36libsite-packagesamqpconnection.py", line 368, in _on_start
    b", ".join(self.mechanisms).decode()))
amqp.exceptions.ConnectionError: Couldn't find appropriate auth mechanism (can offer: AMQPLAIN, PLAIN; available: EXTERNAL)

在没有 ssl 配置的情况下执行相同的代码效果很好。我错过了什么？

我可以使用配置了 SSL 的 pika 向代理发送消息，但我无法正确配置 Celery 以使用 SSL 将消息发送到同一代理。

提前谢谢。

Answer 1

如果您的服务器提供外部身份验证机制，则它可能已经支持 SSL 客户端身份验证。但是，对于 Celery 客户端，您需要一个额外的配置选项来使用外部(即 SSL(身份验证：

app.conf.broker_login_method = 'EXTERNAL'

为了完整起见，有效的芹菜配置代码段如下所示：

...
import ssl
app = Celery("some_name")
app.conf.broker_url = 'amqps://rabbitmq.example.com:5671/vhostname'
app.conf.broker_use_ssl = {
  'keyfile': r'C:pathtoprivatebox1-nopass.key.pem',
  'certfile': r'C:pathtocertsbox1.cert.pem',
  'ca_certs': r'C:pathtoca-chain.cert.pem',
  'cert_reqs': ssl.CERT_REQUIRED
}
app.conf.broker_login_method = 'EXTERNAL'
...

请注意，broker_url中没有用户名：密码，因为用户名由客户端证书的属性确定(并且用户必须预先存在于 RabbitMQ 服务器上，配置有"无密码"(，默认 SSL 端口为 5671(不是 5672(。

Answer 2

尝试使用以下设置：

broker_use_ssl=True

您还可以使用以 amqps://...

Answer 3

你需要启用这个插件：https://github.com/rabbitmq/rabbitmq-auth-mechanism-ssl并将以下配置添加到/etc/rabbitmq/rabbitmq.conf

auth_mechanisms.1 = PLAIN
auth_mechanisms.2 = AMQPLAIN
auth_mechanisms.3 = EXTERNAL

如果您只需要 SSL 连接，则仅添加外部。