ReleaseBytes
aws AWS Big Data Blog ·

Mutual TLS and SSL Certificate Authentication Supported for Amazon MQ for RabbitMQ

blogsecurityawsgaengineer
feature

Amazon MQ for RabbitMQ now supports mutual TLS (mTLS) and SSL certificate authentication for enhanced security. These features help meet compliance requirements for sensitive data by verifying the identity of both clients and brokers using X.509 certificates. Developers and architects using Amazon MQ for RabbitMQ version 4 or later, especially those with stringent security or compliance needs, are affected. SSL certificate authentication enables passwordless login, while mTLS provides two-way certificate-based peer verification alongside username/password, both integrating with AWS Certificate Manager and IAM.

  • →SSL Certificate Authentication for passwordless client login
  • →Mutual TLS for two-way certificate-based peer verification
Features (2) ›
  • SSL Certificate Authentication for passwordless client login

    This feature allows clients to authenticate solely using X.509 client certificates via the EXTERNAL SASL mechanism, eliminating the need for passwords. The broker extracts the username directly from the certificate's Common Name, Distinguished Name, or Subject Alternative Name field.

  • Mutual TLS for two-way certificate-based peer verification

    mTLS enables both the client and broker to prove their identities using certificates, providing two-way authentication for AMQP connections and the RabbitMQ management interface. Unlike SSL certificate authentication, it still requires a username and password at the application layer.

Read the original announcement →

https://aws.amazon.com/blogs/big-data/mutual-tls-and-ssl-certificate-authentication-for-amazon-mq-for-rabbitmq/

Related releases