You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@activemq.apache.org by pwalter <pa...@nasa.gov> on 2014/02/09 23:37:48 UTC

NMS SSL Client Settings

>From article by Tim Bish I was able to use the following client config
settings:
ssl://localhost:61617?transport.acceptInvalidBrokerCert=true

Currently it won't work without the transport setting..
I need to make this more secure (i.e. not accept invalid Broker)

Thanks



--
View this message in context: http://activemq.2283324.n4.nabble.com/NMS-SSL-Client-Settings-tp4677667.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.

Re: NMS SSL Client Settings

Posted by artnaseef <ar...@artnaseef.com>.
Correct - accepting invalid certs is not secure. Your client will connect to any broker using ssl regardless of cert validity in that case. 

Note I sm being a little vague because I am not certain of the NMS settings. 

You want the ssl url without the transport.acceptInvalidBrokerCert=true setting to be secure. 

Sent from my iPhone

> On Feb 9, 2014, at 5:00 PM, "pwalter [via ActiveMQ]" <ml...@n4.nabble.com> wrote:
> 
> Should this work? (removing the transport) with a valid certificate? 
> From: 
> ssl://localhost:61617?transport.acceptInvalidBrokerCert=true 
> TO: 
> ssl://localhost:61617 
> 
> I'm concerned that the transport.acceptInvalidBrokerCert=true is not "secure" 
> 
> 
> Thanks 
> 
> If you reply to this email, your message will be added to the discussion below:
> http://activemq.2283324.n4.nabble.com/NMS-SSL-Client-Settings-tp4677667p4677670.html
> To start a new topic under ActiveMQ - User, email ml-node+s2283324n2341805h3@n4.nabble.com 
> To unsubscribe from ActiveMQ - User, click here.
> NAML




--
View this message in context: http://activemq.2283324.n4.nabble.com/NMS-SSL-Client-Settings-tp4677667p4677671.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.

Re: NMS SSL Client Settings

Posted by pwalter <pa...@nasa.gov>.
Should this work? (removing the transport) with a valid certificate?
From:
ssl://localhost:61617?transport.acceptInvalidBrokerCert=true 
TO:
ssl://localhost:61617

I'm concerned that the transport.acceptInvalidBrokerCert=true is not
"secure"


Thanks



--
View this message in context: http://activemq.2283324.n4.nabble.com/NMS-SSL-Client-Settings-tp4677667p4677670.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.

Re: NMS SSL Client Settings

Posted by artnaseef <ar...@artnaseef.com>.
Are you looking for howto info?

To make server cert checking work, the client must trust the server's cert. That means either get a server (broker) cert signed by a known trusted Certificate Authority (CA) or add the CA that did sign the cert to the client's trusted CA list. 

Sent from my iPhone

> On Feb 9, 2014, at 3:38 PM, "pwalter [via ActiveMQ]" <ml...@n4.nabble.com> wrote:
> 
> 
> From article by Tim Bish I was able to use the following client config settings: 
> ssl://localhost:61617?transport.acceptInvalidBrokerCert=true 
> 
> Currently it won't work without the transport setting.. 
> I need to make this more secure (i.e. not accept invalid Broker) 
> 
> Thanks 
> 
> If you reply to this email, your message will be added to the discussion below:
> http://activemq.2283324.n4.nabble.com/NMS-SSL-Client-Settings-tp4677667.html
> To start a new topic under ActiveMQ - User, email ml-node+s2283324n2341805h3@n4.nabble.com 
> To unsubscribe from ActiveMQ - User, click here.
> NAML




--
View this message in context: http://activemq.2283324.n4.nabble.com/NMS-SSL-Client-Settings-tp4677667p4677668.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.