View a markdown version of this page

Amazon MQ broker TLS certificates - Amazon MQ
Broker identityCertificate typesCommon name and subject alternative names

Amazon MQ broker TLS certificates

Amazon MQ brokers present a server certificate that identifies the broker by its fully qualified domain name (FQDN). Your client is responsible for verifying this certificate when it establishes a TLS connection.

Example FQDN:

b-1234a5b6-78cd-901e-2fgh-3i45j6k178l9.mq.ap-southeast-2.amazonaws.com

We recommend that you configure your client to verify the broker certificate as described in RFC 9525, Service Identity in TLS. When your client connects to an Amazon MQ broker, it should do the following:

  • Use the broker endpoint FQDN as the reference identifier. Use the FQDN from the broker endpoint returned by the DescribeBroker operation, or shown on the broker details page in the Amazon MQ console. Do not derive the identifier from an IP address or from a DNS alias of your own.

  • Verify the identifier against the subjectAltName extension. Match the broker FQDN against the dNSName entries in the certificate subjectAltName (SAN) extension.

  • Do not use the Common Name (CN). The CN does not identify the broker, and it cannot contain the broker FQDN. Clients that match only the CN, or that require a specific value in the CN, might fail to connect.

Important

Do not disable certificate verification, and do not pin an individual broker certificate or a specific certificate subject. Amazon MQ rotates broker certificates, and the contents of the certificate subject can change. Clients that pin a certificate or a subject value might fail to connect after a certificate is rotated.

Note

Most TLS client libraries verify the broker FQDN against the subjectAltName extension by default when you supply the broker endpoint host name. If your client overrides the verification hostname, or supplies its own verification callback, make sure that it uses the broker FQDN and matches against subjectAltName.

The rest of this topic describes the certificate that the broker presents in more detail.

Broker identity

A broker is identified by its fully qualified domain name (FQDN). Obtain the FQDN from the broker endpoint, which is available from the DescribeBroker operation in BrokerInstances[].Endpoints, and from the Endpoint field on the broker details page in the Amazon MQ console. Broker endpoints are full URIs, for example:

amqps://b-1234a5b6-78cd-901e-2fgh-3i45j6k178l9.mq.ap-southeast-2.amazonaws.com:5671

In this example the broker FQDN is b-1234a5b6-78cd-901e-2fgh-3i45j6k178l9.mq.ap-southeast-2.amazonaws.com. The endpoint is different for every broker and every AWS Region, so use the value that Amazon MQ advertises for the specific broker that you are connecting to. Do not derive the identifier from an IP address or from a DNS alias of your own.

Certificate types

To enhance security, Amazon MQ is replacing shared regional wildcard certificates with a separate certificate for each broker.

  • Per-broker certificate. A certificate issued for a single broker. The broker FQDN appears in the subjectAltName (SAN) extension.

  • Regional wildcard certificate (legacy). A certificate shared by the brokers in an AWS Region, whose only subjectAltName entry is a wildcard name. This certificate type is being retired.

Verifying the broker FQDN against the subjectAltName extension, as described in this topic, works with both certificate types.

Common name and subject alternative names

The certificate Common Name (CN) is limited to 64 characters, which a broker FQDN can exceed. On a per-broker certificate the CN therefore contains an opaque label, and the broker FQDN is present in the subjectAltName (SAN) extension.

The SAN extension is the field used for hostname verification. The following example shows the relevant fields of a per-broker certificate. The broker FQDN appears as a DNS entry in subjectAltName, and not in the CN.

Issuer: C=US, O=Amazon, CN=Amazon RSA 2048 M01
Subject: CN=3vmdzfkzqk64xsf3uxk6szu0wiv59w8t.mq.ap-southeast-2.amazonaws.com
X509v3 Subject Alternative Name:
    DNS:3vmdzfkzqk64xsf3uxk6szu0wiv59w8t.mq.ap-southeast-2.amazonaws.com,
    DNS:b-1234a5b6-78cd-901e-2fgh-3i45j6k178l9.mq.ap-southeast-2.amazonaws.com
X509v3 Extended Key Usage: TLS Web Server Authentication
X509v3 Basic Constraints: critical
    CA:FALSE

For comparison, a legacy regional wildcard certificate carries the wildcard name in both the CN and the SAN extension, and does not contain any broker FQDN:

Issuer: C=US, O=Amazon, CN=Amazon RSA 2048 M01
Subject: CN=*.mq.ap-southeast-2.amazonaws.com
X509v3 Subject Alternative Name:
    DNS:*.mq.ap-southeast-2.amazonaws.com
X509v3 Extended Key Usage: TLS Web Server Authentication
X509v3 Basic Constraints: critical
    CA:FALSE

Amazon MQ for ActiveMQ certificates additionally cover the per-instance host names that an active/standby deployment uses, so a client connecting through the Failover Transport verifies successfully against whichever endpoint it uses:

X509v3 Subject Alternative Name:
    DNS:3vmdzfkzqk64xsf3uxk6szu0wiv59w8t.mq.ap-southeast-2.amazonaws.com,
    DNS:b-1234a5b6-78cd-901e-2fgh-3i45j6k178l9.mq.ap-southeast-2.amazonaws.com,
    DNS:b-1234a5b6-78cd-901e-2fgh-3i45j6k178l9-1.mq.ap-southeast-2.amazonaws.com,
    DNS:b-1234a5b6-78cd-901e-2fgh-3i45j6k178l9-2.mq.ap-southeast-2.amazonaws.com