引入SSL时ActiveMQ错误证书 [英] ActiveMQ bad certificate when introduce SSL
问题描述
我正在尝试在ActiveMq中使用openwire + ssl。我正在使用rmohr / activemq提供的docker映像。
I am trying to use openwire+ssl in my ActiveMq. I am using the docker images provided by rmohr/activemq.
由于broker_localhost.cert过期,我运行以下命令来生成必要的文件。
What I ran the following commands to generated necessary files since the broker_localhost.cert has expired.
keytool -genkey -alias broker -keyalg RSA -keystore broker.ks
keytool -export -alias broker -keystore broker.ks -file broker_cert
keytool -genkey -alias client -keyalg RSA -keystore client.ks
keytool -import -alias broker -keystore client.ts -file broker_cert
keytool -export -alias client -keystore client.ks -file client_cert
keytool -import -alias client -keystore broker.ts -file client_cert
然后在 activemq.xml
中添加:
<sslContext keyStore="file:${activemq.base}/certs/ActiveMq/broker.ks"
keyStorePassword="password" trustStore="file:${activemq.base}/certs/ActiveMq/broker.ts"
trustStorePassword="password"/>
以及:
<transportConnector name="openwire+ssl" uri="ssl://0.0.0.0:61617?transport.enabledProtocols=TLSv1"/>
当我运行 docker compose
创建ActiveMQ实例中,我添加了一个环境变量:
When I run docker compose
to create the ActiveMQ instance I added an environment variable as:
environment:
- ACTIVEMQ_SSL_OPTS="-Djavax.net.ssl.keyStore=/opt/activemq/certs/ActiveMq/broker.ks -Djavax.net.ssl.keyStorePassword=password -Djavax.net.ssl.trustStore=/opt/activemq/certs/ActiveMq/broker.ts -Djavax.net.ssl.trustStorePassword=password -Djavax.net.debug=ssl,handshake"
之后,我导入了Windows中先前步骤中生成的broker_cert 作为受信任的根证书颁发机构
管理用户证书。
After that I import the broker_cert generated in the previous steps in Windows Manage user certificates
as Trusted Root Certification Authorities
.
然后我构建我的Asp.Net Core项目以访问ActiveMQ经纪人
Then I build my Asp.Net Core project to access the ActiveMQ broker
var uri = new Uri(@"ssl://localhost:61617?trace=true&needClientAuth=true&transport.serverName='MoveQ Broker'");
ITransportFactory sslTransportFactory = new SslTransportFactory();
((SslTransportFactory)sslTransportFactory).SslProtocol = "Tls";
ITransport transport = sslTransportFactory.CreateTransport(uri);
_connection = new Connection(uri, transport, new IdGenerator());
((Connection)_connection).UserName = "username";
((Connection)_connection).Password = "password";
_session = _connection.CreateSession(AcknowledgementMode.AutoAcknowledge);
但是我不断得到
activemq | WARN | Transport Connection to: tcp://172.17.0.1:35356 failed: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
有人可以帮忙看看我可能错过的步骤吗?
Can anyone help to see what step(s) I may miss?
推荐答案
如果您只需要1向SSL,并且您使用的是自签名证书,则无需在代理上使用信任库或在客户端上使用密钥库。您只需要代理上的密钥库和客户端上的信任库。像这样生成这些资源:
If you just need 1-way SSL and you're using self-signed certificates then you don't need a truststore on the broker or a keystore on the client. You just need a keystore on the broker and a truststore on the client. Generate these resources like so:
keytool -genkey -keystore broker-keystore.ks
keytool -export -keystore broker-keystore.ks -file broker.cer
keytool -import -keystore client-truststore.ks -file broker.cer
然后在代理上使用 broker-keystore.ks
,在代理上使用 client-truststore.ks
客户。
Then use broker-keystore.ks
on the broker and client-truststore.ks
on the client.
这篇关于引入SSL时ActiveMQ错误证书的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!