Comment 2 for bug 1496001

Revision history for this message
Major Hayden (rackerhacker) wrote :

Encrypted communication is required in PCI environments as required by sections 2 and 4 of PCI DSS 3.1. Although cardholder data doesn't pass through RabbitMQ directly, an attacker could use data that may appear in RabbitMQ messages to gain additional access to systems on the network.

My goal here is to do something *additive*. Fixing this bug should allow RabbitMQ to use TLS-encrypted connections but it shouldn't have any impact on existing plaintext connections.