Amazon MQ OpenWire .NET clients started failing en masse

Question

It seems like sometime in the last week, maybe starting 1/12/25, my .NET Core 2.2 application connecting to Amazon MQ over SSL started failing across the board, all clients at once.

The .NET client is using Apache.NMS.ActiveMQ to read messages off Amazon MQ using OpenWire protocol on port 61617. The application does produce an error but it's very low level and not very helpful -- starting the connection results in an exception with the message "Authentication failed, see inner exception" wrapped around an exception saying "The function requested is not supported." All emanating from somewhere in System.Net.Security.SslState.

I'm here grasping at straws to rule out causes. The broker's username and password are correct and it doesn't make a difference if I try to make the app connect with an invalid credential - same result - so this "Authentication failed" message seems like a red herring. The issue doesn't seem to be network/firewall related as it is happening from devices both inside and outside our firewalls. I don't see anything in the Amazon MQ release logs that could give a clue as to why. Our Amazon MQ broker is running and nothing seems to have been changed there.

re:Post Agent · Answer

Based on the information provided, it appears that your Amazon MQ OpenWire .NET clients are experiencing connection issues, possibly related to SSL/TLS authentication. While the exact cause isn't immediately clear, there are several potential factors to consider:

1. Certificate rotation: Amazon MQ periodically rotates broker endpoint certificates to ensure continued security and availability. If this occurred recently, it could explain the sudden widespread failure of your clients.

2. SSL/TLS version mismatch: The error message "The function requested is not supported" from System.Net.Security.SslState might indicate an incompatibility between the SSL/TLS versions supported by your client and the broker.

3. Trust store issues: Your clients may not have the correct or up-to-date root certificate authority (CA) in their trust store to validate the broker's certificate.

To troubleshoot and potentially resolve this issue:

1. Update your client's trust store: Use the Amazon root certificate authority (CA) from Amazon Trust Services in your clients' trust stores. This approach ensures that your clients can authenticate against the broker even when certificates are rotated.

2. Check SSL/TLS versions: Ensure that your .NET Core 2.2 application and the Amazon MQ broker are using compatible SSL/TLS versions. You may need to update your client to support the latest SSL/TLS version used by Amazon MQ.

3. Verify broker status: Although you mentioned the broker is running, double-check its status and any recent changes or maintenance that might have occurred.

4. Review client library: Consider updating the Apache.NMS.ActiveMQ library to the latest version compatible with your .NET Core 2.2 application, as newer versions might have fixes for SSL/TLS-related issues.

5. Enable detailed logging: If possible, enable more detailed logging in your application to get more information about the SSL handshake process and any specific errors occurring during the connection attempt.

6. Check for any recent changes: Review any recent changes in your application code, configuration, or network environment that might have coincided with the onset of this issue.

If these steps don't resolve the issue, you may need to contact AWS Support for further assistance, providing them with detailed logs and information about your setup.  
**Sources**  
[Troubleshooting: General Amazon MQ - Amazon MQ](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/general.html)  
[Amazon MQ for RabbitMQ best practices - Amazon MQ](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/best-practices-rabbitmq.html)

Amazon MQ OpenWire .NET clients started failing en masse

Add your answer

Relevant content