How to debug "pika.exceptions.AuthenticationError: EXTERNAL" error when establishing TLS connection to RabbitMQ?

Question

我在 Ubuntu 14.04 运行 上有一个 RabbitMQ 3.6.1 服务器。我尝试根据 official documentation 配置 SSL 侦听器。启动过程中没有问题。

然而，在尝试建立连接时，我在 Python/pika 端收到以下错误（下面是完整的记录）：

pika.exceptions.AuthenticationError: EXTERNAL

这里的EXTERNAL是什么意思？如何调试/获取错误的更多详细信息？

---

操作过程（为了测试我使用了 Vagrant box 和本地连接）：

1. RabbitMQ 在端口 5671 上启动 SSL 侦听器（根据 /var/log/rabbitmq/rabbit@rabbitmq-server.log）：

   started SSL Listener on [::]:5671
   

2. 我在客户端执行pika.BlockingConnection

3. 在服务器端我可以看到传入连接：

   =INFO REPORT==== 17-Apr-2016::17:07:15 ===
   accepting AMQP connection <0.2788.0> (127.0.0.1:48404 -> 127.0.0.1:5671)
   

4. 客户端失败：

   pika.exceptions.AuthenticationError: EXTERNAL
   

5. 服务器超时：

   =ERROR REPORT==== 17-Apr-2016::17:07:25 ===
   closing AMQP connection <0.2788.0> (127.0.0.1:48404 -> 127.0.0.1:5671):
   {handshake_timeout,frame_header}
   

---

客户端完整成绩单：

>>> import pika, ssl
>>> from pika.credentials import ExternalCredentials
>>> ssl_options = ({"ca_certs": "/etc/rabbitmq/certs/testca/cacert.pem",
...                 "certfile": "/etc/rabbitmq/certs/client/cert.pem",
...                 "keyfile": "/etc/rabbitmq/certs/client/key.pem",
...                 "cert_reqs": ssl.CERT_REQUIRED,
...                 "server_side": False})
>>> host = "localhost"
>>> connection = pika.BlockingConnection(
...                  pika.ConnectionParameters(
...                      host, 5671, credentials=ExternalCredentials(),
...                      ssl=True, ssl_options=ssl_options))
Traceback (most recent call last):
  File "<stdin>", line 4, in <module>
  File "/usr/local/lib/python2.7/dist-packages/pika/adapters/blocking_connection.py", line 339, in __init__
    self._process_io_for_connection_setup()
  File "/usr/local/lib/python2.7/dist-packages/pika/adapters/blocking_connection.py", line 374, in _process_io_for_connection_setup
    self._open_error_result.is_ready)
  File "/usr/local/lib/python2.7/dist-packages/pika/adapters/blocking_connection.py", line 410, in _flush_output
    self._impl.ioloop.poll()
  File "/usr/local/lib/python2.7/dist-packages/pika/adapters/select_connection.py", line 602, in poll
    self._process_fd_events(fd_event_map, write_only)
  File "/usr/local/lib/python2.7/dist-packages/pika/adapters/select_connection.py", line 443, in _process_fd_events
    handler(fileno, events, write_only=write_only)
  File "/usr/local/lib/python2.7/dist-packages/pika/adapters/base_connection.py", line 364, in _handle_events
    self._handle_read()
  File "/usr/local/lib/python2.7/dist-packages/pika/adapters/base_connection.py", line 415, in _handle_read
    self._on_data_available(data)
  File "/usr/local/lib/python2.7/dist-packages/pika/connection.py", line 1347, in _on_data_available
    self._process_frame(frame_value)
  File "/usr/local/lib/python2.7/dist-packages/pika/connection.py", line 1414, in _process_frame
    if self._process_callbacks(frame_value):
  File "/usr/local/lib/python2.7/dist-packages/pika/connection.py", line 1384, in _process_callbacks
    frame_value)  # Args
  File "/usr/local/lib/python2.7/dist-packages/pika/callback.py", line 60, in wrapper
    return function(*tuple(args), **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/pika/callback.py", line 92, in wrapper
    return function(*args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/pika/callback.py", line 236, in process
    callback(*args, **keywords)
  File "/usr/local/lib/python2.7/dist-packages/pika/connection.py", line 1298, in _on_connection_start
    self._send_connection_start_ok(*self._get_credentials(method_frame))
  File "/usr/local/lib/python2.7/dist-packages/pika/connection.py", line 1077, in _get_credentials
    raise exceptions.AuthenticationError(self.params.credentials.TYPE)
pika.exceptions.AuthenticationError: EXTERNAL
>>>

Answer 1

题目中的Python / pika代码正确

错误：

pika.exceptions.AuthenticationError: EXTERNAL

在RabbitMQ服务器端没有启用客户端证书授权时报错。错误中的单词 EXTERNAL 将身份验证机制称为 described here。

启用：

rabbitmq-plugins enable rabbitmq_auth_mechanism_ssl