Mailing-List: contact users-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@activemq.apache.org
Received-SPF: pass (athena.apache.org: domain of dave@stormpath.com designates
 209.85.160.45 as permitted sender)
From: David Laube <dave@stormpath.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Subject: networkConnector over SSL results in certificate exception - AMQ
 5.9.0
Message-Id: <45435BDF-DF02-412A-8D97-D443DDF36B59@stormpath.com>
Date: Mon, 17 Feb 2014 12:00:43 -0800
To: "users@activemq.apache.org" <users@activemq.apache.org>
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))

Hi All,

We're experiencing some issues trying to get two brokers running on a =
single host (for simplicity) talking to each other using a =
networkConnector over SSL. I suspect I'm missing something somewhere, I =
just haven't found it yet ;) I've packaged two ActiveMQ 5.9.0 =
installations into a single project available at =
https://github.com/dlaube/amq-example along with a script (see below) to =
generate broker and client keyStores and trustStores according to =
http://activemq.apache.org/how-do-i-use-ssl.html

The script to generate the broker/client trustStore and keyStores is =
amq-example/apache-activemq-5.9.0-b/conf/gen-certs.sh


Broker-a =3D (directory apache-activemq-5.9.0) Default 5.9.0 config with =
sslContext and a single networkConnector which connects to Broker-b =
using the SSL protocol/transport via the following;
<networkConnector name=3D"NC_toBroker-b_SSL" duplex=3D"true" =
uri=3D"static:(ssl://localhost:61626)"/>

Broker-b =3D (directory apache-activemq-5.9.0-b) An ActiveMQ 5.9.0 =
config with sslContext and a single transportConnector using the =
following;
<transportConnector name=3D"ssl" =
uri=3D"ssl://0.0.0.0:61626?maximumConnections=3D1000&amp;wireFormat.maxFra=
meSize=3D104857600"/>


Broker-a logs:
2014-02-17 11:16:20,357 | WARN  | Could not start network bridge =
between: vm://broker-a?async=3Dfalse&network=3Dtrue and: =
ssl://localhost:61626 due to: javax.net.ssl.SSLHandshakeException: =
sun.security.validator.ValidatorException: PKIX path validation failed: =
java.security.cert.CertPathValidatorException: signature check failed | =
org.apache.activemq.network.DiscoveryNetworkConnector | ActiveMQ Task-7

Broker-b logs:
2014-02-17 11:15:20,302 | ERROR | Could not accept connection from =
tcp://127.0.0.1:50663: javax.net.ssl.SSLHandshakeException: Received =
fatal alert: certificate_unknown | =
org.apache.activemq.broker.TransportConnector | ActiveMQ =
BrokerService[broker-b] Task-9


I have followed http://activemq.apache.org/certificateunknown.html in =
that the client ts has been copied to broker-a. I have also tried =
setting the following properties inside the ACTIVEMQ_OPTS variable =
within bin/activemq;

javax.net.ssl.keyStore=3D/path/to/client.ks
javax.net.ssl.keyStorePassword=3Dpassword
javax.net.ssl.trustStore=3D/path/to/client.ts

Does anyone see any problems with my config or keyStore/trustStore =
setup? Any insight would be greatly appreciated. Thanks in advance!

Best regards,
-David Laube=