How to set rabbitmq_management only listen on port 15671?

[HScarb]

I config Rabbitmq according to https://www.rabbitmq.com/management.html#single-listener-https like this

management.listener.ssl=true
management.ssl.port = 15671
management.ssl.ip = 172.31.x.x

But the management plugin still listens on 0.0.0.0:15672 and 172.31.x.x:15671, how to set rabbitmq_management only to listen on port 15671?

Rabbitmq version: 3.8.35

[stgns]

Hello @HScarb,

I've had a similar issue and I've managed to solve it by applying an extraconfiguration parameters, as follows:

extraConfiguration: |-
  management.tcp.port         = 15672
  management.ssl.port          = 15671
  management.ssl.cacertfile = /opt/bitnami/rabbitmq/certs/ca_certificate.pem
  management.ssl.certfile     = /opt/bitnami/rabbitmq/certs/server_certificate.pem
  management.ssl.keyfile      = /opt/bitnami/rabbitmq/certs/server_key.pem

My issue ticket is this:
bitnami/charts#30035

Hope this can help :)

[michaelklishin]

Your example makes the plugin bind to port 15672 without TLS, and the question explicitly states that this person only wants the TLS listener.

I'm not sure how this is different from the documentation otherwise.

[stgns]

Maybe the management.tcp.port = 15672 is not needed. You're right.

I got it working with this port aslo defined. Maybe it's uneeded. Only 15671 is needed for HTTPS, obviously. Thanks for the clarification.

[michaelklishin]

I will copy a response in #12544 here because apparently someone still lands on this discussion in late 2024.

As for a way to disable the regular TCP listener, it is as trivial as not configuring it at all.

Given the following rabbitmq.conf:

#
# Management
#

management.http_log_dir = /tmp/rabbitmq-http-api/logs/

management.ssl.port = 15671

management.ssl.cacertfile = /path/to/tls-gen.git/basic/result/ca_certificate.pem
management.ssl.certfile   = /path/to/tls-gen.git/basic/result/server_certificate.pem
management.ssl.keyfile    = /path/to/tls-gen.git/basic/result/server_key.pem

You will get the following listeners enabled:

rabbitmq-diagnostics listeners | grep "HTTP API"
# => Interface: [::], port: 15671, protocol: https, purpose: HTTP API over TLS (HTTPS)

In other words, there will be just one listener enabled. This is exactly what the HTTPS section of the docs claims, with joint HTTP/HTTPS setup being documented separately for this reason.