title: Celery - RabbitMQ as a Service - Broker Secure Connection (TSL/SSL) - Message Signing
body: <p>I am trying to configure <a href="http://docs.celeryproject.org/en/latest/" rel="noreferrer">Celery</a> on my Django web server securely and I can figure out two alternatives on achieving this. Either securing the broker or signing the messages. </p>
  
  <ul>
  <li><p>Celery, needs a message broker in which case is <a href="https://www.rabbitmq.com/documentation.html" rel="noreferrer">RabbitMQ</a>.</p>
  
  <p>I am using a "RabbitMQ as a service" implementation, which means that the RabbitMQ server is reached through the internet using the <a href="https://www.amqp.org/" rel="noreferrer">amqp</a> protocol.</p>
  
  <p>The service provider distributes an <a href="https://www.rabbitmq.com/uri-spec.html" rel="noreferrer">amqp uri</a>, and also supports amqps:</p>
  
  <blockquote>
    <p>The "amqps" URI scheme is used to instruct a client to make an secured connection to the server. </p>
  </blockquote>
  
  <ul>
  <li><a href="http://docs.celeryproject.org/en/latest/userguide/security.html#broker" rel="noreferrer">Apparently</a>, this is what I need, otherwise all my messages will be circulating around the net, naked on the wire.</li>
  </ul>
  
  <p>In order to use amqps, celery needs the following <a href="http://docs.celeryproject.org/en/latest/configuration.html?highlight=ssl#std:setting-BROKER_USE_SSL" rel="noreferrer">configuration</a>:</p>
  
  <pre><code>import ssl
  
  BROKER_USE_SSL = {
    'keyfile': '/var/ssl/private/worker-key.pem',
    'certfile': '/var/ssl/amqp-server-cert.pem',
    'ca_certs': '/var/ssl/myca.pem',
    'cert_reqs': ssl.CERT_REQUIRED
  }
  </code></pre>
  
  <p><strong>Question:</strong>
  Where can I find those <code>.pem</code> files? </p>
  
  <p>According to <a href="https://www.rabbitmq.com/ssl.html" rel="noreferrer">RabbitMQ docs</a>, I have to create them myself and configure the RabbitMQ server to use them. </p>
  
  <p>However, I am not running the server. As stated above I have a "RabbitMQ as a service" provider who supports amqps. Should I ask him to provide me with those <code>.pem</code> files? </p></li>
  <li><p>Celery, can also <a href="http://docs.celeryproject.org/en/latest/userguide/security.html#message-signing" rel="noreferrer">sign messages</a>. </p>
  
  <p>(Trying this approach, I get a <code>No encoder installed for auth</code> error which <a href="https://github.com/celery/celery/issues/3445" rel="noreferrer">I reported</a>.)</p>
  
  <p><strong>Question:</strong> Does this mean that I can use my certificates to secure the connection as an alternative configuration to <code>BROKER_USE_SSL</code>?</p>
  
  <p>There is also a note regarding message signing:</p>
  
  <blockquote>
    <p>auth serializer won’t encrypt the contents of a message, so if needed
    this will have to be enabled separately.</p>
  </blockquote>
  
  <p><strong>Subquestion:</strong> Does encrypting the contents of a message protect me from the "current" RabbitMQ server administrator while "message signing" only protects me while on the wire towards that server?</p></li>
  </ul>
  
  <p>Apparently I am somehow confused but I would not like to create any kind of insecure traffic over the internet for any reason. I would appreciate your help.</p>