🐰 RabbitMQ Error: AMQP 1.0 connection failed / plugin not enabled

Exact Error Message

An AMQP 1.0 client failing to connect to a broker that has not enabled the protocol typically times out on the SASL/open handshake:

amqp.exceptions.ConnectionForced: Connection refused: the peer closed the socket
 during the AMQP 1.0 SASL negotiation (frame 'sasl-init')

On older RabbitMQ (3.x) where AMQP 1.0 is a plugin, the broker log shows nothing because the listener never handled the frame. With native AMQP 1.0 (4.x) an auth or vhost problem surfaces in the log as:

2026-07-17 11:20:04.512 [warning] <0.977.0> AMQP 1.0 connection from 10.0.6.14:52210 rejected:
 sasl-outcome 'auth-failed' for user 'svc-orders' (vhost mapping '/' )

A link attach to a missing address closes the link:

detach: error amqp:not-found "no queue 'orders' in vhost '/'"

What It Means

AMQP 1.0 is a different protocol from the AMQP 0-9-1 that RabbitMQ is best known for. In RabbitMQ 3.x, AMQP 1.0 is provided by the rabbitmq_amqp1_0 plugin, which must be explicitly enabled. In RabbitMQ 4.0 and later, AMQP 1.0 is supported natively by the core server (no plugin) and shares the standard 5672 / 5671 (TLS) ports.

A “connection failed” therefore usually means one of: the plugin is not enabled (3.x), the client is pointed at the wrong port, SASL authentication failed, or the client’s target address does not map to a real exchange/queue in the expected vhost. AMQP 1.0 uses SASL for auth and terminus addresses (like /queues/orders or /exchanges/amq.topic/key) rather than the 0-9-1 exchange/routing-key model.

Common Causes

• On RabbitMQ 3.x, the rabbitmq_amqp1_0 plugin is not enabled.
• The client connects to a management or non-AMQP port instead of 5672/5671.
• SASL credentials are wrong, or the mechanism (PLAIN vs ANONYMOUS/EXTERNAL) is not permitted.
• The default vhost mapping does not match where the queues/exchanges actually live.
• The link’s target/source address does not resolve to an existing queue or exchange.
• TLS mismatch when the client uses amqps:// but the broker has no TLS listener.

Diagnostic Commands

Check whether AMQP 1.0 is available. On 3.x, confirm the plugin is enabled:

rabbitmq-plugins list -e | grep amqp1_0

Confirm the AMQP listeners and ports the broker is actually serving:

rabbitmq-diagnostics listeners
rabbitmqctl environment | grep -iE 'tcp_listeners|ssl_listeners'

Verify the user exists and has permissions on the target vhost:

rabbitmqctl authenticate_user svc-orders 'REDACTED'
rabbitmqctl list_permissions --vhost /

Watch the log for AMQP 1.0 rejections during a connection attempt:

journalctl -u rabbitmq-server --since "5 min ago" | grep -iE 'amqp 1.0|sasl|auth-failed|amqp:not-found'

Step-by-Step Resolution

1. Determine your RabbitMQ version, since AMQP 1.0 is a plugin on 3.x and native on 4.x:

   rabbitmqctl version

2. On RabbitMQ 3.x, enable the plugin and restart the client connection:

   rabbitmq-plugins enable rabbitmq_amqp1_0

3. On RabbitMQ 4.x, no plugin is needed — remove any rabbitmq_amqp1_0 from your enabled list and rely on the native AMQP 1.0 support on port 5672.

4. Point the client at the correct port and scheme. Use amqp://host:5672 for plaintext or amqps://host:5671 for TLS. Do not use the management port 15672.

5. Fix SASL auth. Use the PLAIN mechanism with a valid user, and confirm credentials work:

   rabbitmqctl authenticate_user svc-orders 'the-password'

6. Map the vhost and address correctly. With native AMQP 1.0, target addresses like /queues/orders or /exchanges/amq.topic/orders.created must reference topology that exists; declare the queue/exchange first with rabbitmqctl or the management API.

7. Verify the connection is up:

   rabbitmqctl list_connections name protocol user state | grep -i 'AMQP 1.0'

Prevention

• Standardize on RabbitMQ 4.x where AMQP 1.0 is native and avoids the plugin lifecycle entirely.
• Pin the correct port and TLS scheme in client config; never point AMQP clients at the management port.
• Pre-declare the queues and exchanges that AMQP 1.0 addresses resolve to, as part of deployment.
• Validate SASL credentials and per-vhost permissions in CI before rollout.
• Log and alert on auth-failed and amqp:not-found outcomes. The prompt library includes prompts for generating protocol-migration and connection-test checklists.

Related Errors

• bad header / protocol mismatch — a client speaking 0-9-1 to an AMQP 1.0 endpoint or vice versa.
• access_refused (403) — the user authenticated but lacks permission on the vhost or resource.
• authentication_failure_close — the 0-9-1 equivalent of an AMQP 1.0 auth-failed SASL outcome.
• connection refused — nothing is listening on the port, often a wrong port or a firewall.

Frequently Asked Questions

Do I still need the rabbitmq_amqp1_0 plugin? Only on RabbitMQ 3.x. From 4.0 onward AMQP 1.0 is supported natively by the core broker with no plugin.

Which port does AMQP 1.0 use? The same as AMQP 0-9-1: 5672 for plaintext and 5671 for TLS. The management port 15672 is not an AMQP port.

Why does my link attach fail with amqp:not-found? The source/target address does not resolve to an existing queue or exchange in the target vhost; declare the topology first.

How is addressing different from AMQP 0-9-1? AMQP 1.0 uses terminus addresses like /queues/orders rather than the 0-9-1 exchange-plus-routing-key publish model.

Why does auth work on 0-9-1 but fail on AMQP 1.0? AMQP 1.0 negotiates auth over SASL; confirm the mechanism is PLAIN and the user maps to the expected vhost. For more, see the RabbitMQ guides.