Mutual TLS and SSL certificate authentication for Amazon MQ for RabbitMQ

This article explains two certificate-based security features for Amazon MQ for RabbitMQ that enable compliance-compliant authentication and peer verification.

• SSL certificate authentication uses X.509 certificates as sole credentials via EXTERNAL SASL mechanism, eliminating passwords entirely
• Mutual TLS (mTLS) provides certificate-based peer verification while maintaining username/password authentication at application layer
• Both features extract certificates from AWS Certificate Manager (ACM) using IAM roles and AWS ARNs
• SSL certificate authentication extracts username from certificate fields: Common Name, Distinguished Name, or Subject Alternative Name
• mTLS secures AMQP connections and RabbitMQ management interface with two-way certificate verification
• SSL certificate authentication suits passwordless PKI environments; mTLS adds transport-layer verification to existing credential-based deployments

Both methods support Amazon MQ for RabbitMQ version 4 and above, with implementation guides and AWS CDK samples available for deployment.