activemq-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Charlie P." ...@kaya.io>
Subject Re: SSL problems with apollo 1.7, unknown_ca error
Date Sun, 27 Apr 2014 07:57:32 GMT
Problem was resolved by creating a new JKS with the entire certificate chain added. Interestingly,
the web admin page worked fine without the chain but the MQTT connector did not.

Can anybody advise how we can get this fix added as a note in the docs?

On 25 April 2014 at 10:36:50 am, Charlie P. (cp@kaya.io) wrote:

Hi all,

I'm trying to install Apollo 1.7 and set SSL with my own server certificate (issued by startcom).

Steps performed:
Created JKS
Imported my private key using keytool
Configured apollo.xml to use my new keytool.
Now the web admin HTTPS interface works fine, but its the ssl connection to the mqtt broker
that isn't working. I've been testing using mosquitto_pub and get this:

mosquitto_pub -h dev.kaya.io -p 61614 -f ~/input  -t chazman --cafile /media/truecrypt1/SSL/kaya-startssl/ca.pem
-d
Client mosqpub/10571-brahma sending CONNECT
OpenSSL Error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify
failed
Error: Protocol error

In my Stacktrace.log I get these errors below. Does anyone have any ideas whats wrong?

--- LOGS

==> connection.log <==
2014-04-25 10:35:47,614 connected: local:/127.0.0.1:61614, remote:/127.0.0.1:42632

==> apollo.log <==
2014-04-25 10:35:47,972 | INFO  | javax.net.ssl.SSLException: Received fatal alert: unknown_ca
| 14596bd0785

==> stacktrace.log <==
2014-04-25 10:35:47,973 | INFO  | stackref=14596bd0785
javax.net.ssl.SSLException: Received fatal alert: unknown_ca
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
    at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1630)
    at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1598)
    at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1767)
    at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1063)
    at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:887)
    at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:761)
    at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
    at org.fusesource.hawtdispatch.transport.SslTransport.secure_read(SslTransport.java:369)
    at org.fusesource.hawtdispatch.transport.SslTransport.handshake(SslTransport.java:434)
    at org.fusesource.hawtdispatch.transport.SslTransport.drainInbound(SslTransport.java:274)
    at org.fusesource.hawtdispatch.transport.TcpTransport$6.run(TcpTransport.java:588)
    at org.fusesource.hawtdispatch.internal.NioDispatchSource$3.run(NioDispatchSource.java:209)
    at org.fusesource.hawtdispatch.internal.SerialDispatchQueue.run(SerialDispatchQueue.java:100)
    at org.fusesource.hawtdispatch.internal.pool.SimpleThread.run(SimpleThread.java:77)

==> connection.log <==
2014-04-25 10:35:47,977 disconnected: local:/127.0.0.1:61614, remote:/127.0.0.1:42632






Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message