mTLS client cert chain not sent when tls_cert is a multi-PEM bundle

[RamyaSaba]

Question

Can this project provide a fix so that tls_cert sends the full certificate chain (leaf + intermediate CA), not only the first PEM?

We use mTLS from Fluentd (fluent-plugin-rabbitmq / fluent-plugin-amqp) to RabbitMQ. Certificates are issued by an Intermediate CA (cert-manager / Kubernetes TLS secret):

• tls.crt = leaf, then intermediate(s)
• tls.key = leaf private key
• ca.crt = Root CA only

The broker trusts the Root only. For the handshake to succeed, the client needs to present the Intermediate as well.

What happens today

tls_cert is loaded here:
https://github.com/ruby-amqp/bunny/blob/2.14.4/lib/bunny/transport.rb

ctx.cert = OpenSSL::X509::Certificate.new(@tls_certificate) if @tls_certificate
That keeps only the first certificate in the file. When we point tls_cert at a multi-PEM chain, mTLS to a Root-only broker fails (tlsv1 alert unknown ca).
Observed with Bunny 2.14.4. The Fluentd plugins expose tls_cert / tls_key / tls_ca_certificates and pass them to Bunny; they do not set a chain on the SSL context.

Will you provide a fix for this? If work is already planned, can you point us to the issue or target release so we can follow it?

Thanks.

[michaelklishin]

@RamyaSaba first of all, issues are not supposed to be used for questions.

"This project" is open source software that does not implement TLS. You can provide a fix, asking others to fix something you need is not how open source software works.

[michaelklishin]

Fixed in #750 by @eglitobias, scheduled to ship some time soon in 3.3.0.