You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@activemq.apache.org by darkrwe <em...@gmail.com> on 2013/11/07 11:13:06 UTC
Re: setting up c++ client app using CMS using SSL client
certificate auth
Hello guys,
I have same problem too.
I'm getting below error on the client side (ubuntu 13.04 -same machine with
the client)
Error occurred while accessing an OpenSSL library method:
error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal
error
I'm also getting below error from broker side (ubuntu 13.04 -same machine
with the client)
2013-11-07 12:04:22,244 | ERROR | Could not accept connection from
tcp://127.0.0.1:55751: javax.net.ssl.SSLException:
java.security.ProviderException:
sun.security.pkcs11.wrapper.PKCS11Exception: CKR_DOMAIN_PARAMS_INVALID |
org.apache.activemq.broker.TransportConnector | ActiveMQ
BrokerService[localhost] Task-3
I could not figure out how to enabled ssl debug mode ? Can you help me about
execution below command?
-Djava.net.debug=ssl
and how you solve this problem guys ?
Thank you.
--
View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4673995.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: setting up c++ client app using CMS using SSL client
certificate auth
Posted by darkrwe <em...@gmail.com>.
I export the below environment parameter.
export ACTIVEMQ_OPTS="-Djava.net.debug=ssl"
But i have not seen any ssl handshake between client and broker in the
activeMQBase/data/activemq.log file.
is there another log file that i trace the result?
Thanks.
--
View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4674028.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: setting up c++ client app using CMS using SSL client
certificate auth
Posted by mikmela <mi...@yahoo.com>.
It is definitely not an ActiveMQ issue... You can look into PKI software from various vendors or try to implement something yourself for example using web services...
Sent from my HTC One on the Verizon Wireless 4G LTE network
----- Reply message -----
From: "darkrwe [via ActiveMQ]" <ml...@n4.nabble.com>
To: "mikmela" <mi...@yahoo.com>
Subject: setting up c++ client app using CMS using SSL client certificate auth
Date: Tue, Nov 26, 2013 4:12 AM
Thank you very much,
What I want to do is I want to create an ActiveMQ cluster.
This cluster will use mutual authentication.(client and broker)
And each activeMQ client should generate own certificate and this certificate should be signed by an private CA authority that I set it up. This new client certificate should also be added to broker truststore to provide mutual authentication.
But the problem is I do not know how to automate this process.
Actually that is the my question.
If you give me a clue that will be gorgeous.
Thank you again.
If you reply to this email, your message will be added to the discussion below:
http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4674842.html
To unsubscribe from setting up c++ client app using CMS using SSL client certificate auth, click here.
NAML
--
View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4674958.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: setting up c++ client app using CMS using SSL client
certificate auth
Posted by darkrwe <em...@gmail.com>.
Thank you very much,
What I want to do is I want to create an ActiveMQ cluster.
This cluster will use mutual authentication.(client and broker)
And each activeMQ client should generate own certificate and this
certificate should be signed by an private CA authority that I set it up.
This new client certificate should also be added to broker truststore to
provide mutual authentication.
But the problem is I do not know how to automate this process.
Actually that is the my question.
If you give me a clue that will be gorgeous.
Thank you again.
--
View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4674842.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: setting up c++ client app using CMS using SSL client certificate
auth
Posted by Timothy Bish <ta...@gmail.com>.
On 11/25/2013 12:26 PM, darkrwe wrote:
> Hi guys;
>
> I wonder something about SSL/TLS authentication of ActiveMQ
>
> is there any way to authenticate activemq-cpp clients to add these clients
> public keys to broker truststore automatically?
>
>
>
> --
> View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4674827.html
> Sent from the ActiveMQ - User mailing list archive at Nabble.com.
>
No, you need to add the trusted client keys or the Root CA to your
broker's truststore manually.
--
Tim Bish
Sr Software Engineer | RedHat Inc.
tim.bish@redhat.com | www.fusesource.com | www.redhat.com
skype: tabish121 | twitter: @tabish121
blog: http://timbish.blogspot.com/
Re: setting up c++ client app using CMS using SSL client
certificate auth
Posted by darkrwe <em...@gmail.com>.
Hi guys;
I wonder something about SSL/TLS authentication of ActiveMQ
is there any way to authenticate activemq-cpp clients to add these clients
public keys to broker truststore automatically?
--
View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4674827.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: setting up c++ client app using CMS using SSL client
certificate auth
Posted by darkrwe <em...@gmail.com>.
Hello Mikmela,
i have solved the issue. thank you for reply.
My mistake is here i didnot add the -nokeys argument the truststore
openssl.exe pkcs12 -in %broker%.p12 -out %client%_ts.pem -nokeys
Thank you guys.
Have a nice day.
--
View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4674061.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: setting up c++ client app using CMS using SSL client
certificate auth
Posted by mikmela <mi...@yahoo.com>.
*error:0906D06C:PEM routines:PEM_read_bio:no start line
error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
*
appears if a private key is not found during SSL handshake
Overall, looks like you're on a right path...
You enabled client auth... Therefore for successful handshake you need to
configure keystore (jks file) with broker private key and truststore (jks)
with public keys of the clients your broker should trust...
On client side, you need the same thing a) keystore (pem file due to CMS
requirement) to store client's private key and b)trustore (pem) format to
store public key of the broker you trust...
So, make sure:
a) you use
openssl.exe pkcs12 -in *%client%.p12* -out *%client%_ks.pem *
to create client keystore
b)you use
openssl.exe pkcs12 -in %broker%.p12 -out %client%_ts.pem -nokeys
And of course, make sure you don't mix it up references to these files when
you set it as properties in your CMS-based c++ code.
--
View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4674033.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: setting up c++ client app using CMS using SSL client certificate
auth
Posted by Timothy Bish <ta...@gmail.com>.
On 11/07/2013 12:12 PM, darkrwe wrote:
> Hi Tim,
> thank you for answer.
> I installed oracle JDK7 and now i don't get below problems.
> Now I just want to summarize what i do.. Because my pem file is problematic
> in client side.
> Maybe another configuration i could miss.
>
>> I'm getting below error on the client side (ubuntu 13.04 -same machine
>> with
>> the client)
>> Error occurred while accessing an OpenSSL library method:
>> error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal
>> error
>>
>> I'm also getting below error from broker side (ubuntu 13.04 -same machine
>> with the client)
>> 2013-11-07 12:04:22,244 | ERROR | Could not accept connection from
>> tcp://127.0.0.1:55751: javax.net.ssl.SSLException:
>> java.security.ProviderException:
>> sun.security.pkcs11.wrapper.PKCS11Exception: CKR_DOMAIN_PARAMS_INVALID |
>> org.apache.activemq.broker.TransportConnector | ActiveMQ
>> BrokerService[localhost] Task-3
> *But now I have got the these error from client:*
> *Error occurred while accessing an OpenSSL library method:
> error:0906D06C:PEM routines:PEM_read_bio:no start line
> error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib*
>
>
> *I use below configuration in my cms client:*
> I also enabled SSL in activeMQ.(installed openSSL and added proper prefix to
> activeMQ installation)
> activemq::library::ActiveMQCPP::initializeLibrary();
> decaf::lang::System::setProperty(
> "decaf.net.ssl.keyStore","/pathToPem/Client.pem");
> decaf::lang::System::setProperty("decaf.net.ssl.keyStorePassword",
> "123456");
> decaf::lang::System::setProperty( "decaf.net.ssl.trustStore",
> "/pathToPem/Broker.pem" );
> url ="ssl://localhost:61617";
>
> in broker side i have done below configurations:
> *in activemq.xml:*
>
> <sslContext>
> <sslContext
> keyStore="broker.ks" keyStorePassword="123456"
> trustStore="client.ks" trustStorePassword="123456"/>
> </sslContext>
> <transportConnectors>
> <transportConnector name="ssl"
> uri="ssl://localhost:61617?needClientAuth=true" />
> <transportConnector name="openwire" uri="tcp://0.0.0.0:61616?
> maximumConnections=1000&wireformat.maxFrameSize=104857600"/>
> <transportConnector name="amqp"
> uri="amqp://0.0.0.0:5672?maximumConnections=1000&wireformat.maxFrameSize=104857600"/>
> </transportConnectors>
>
> *I also export the SSL_OPTS environment parameter before starting the
> broker:*
> $ export SSL_OPTS="-Djavax.net.ssl.keyStore=/pathTobrokerks/broker.ks
> -Djavax.net.ssl.keyStorePassword=123456
> -Djavax.net.ssl.trustStore=/pathTobrokerts/broker.ts"
>
> Below commands for generating keystores and certificates:
> $ keytool -genkey -alias broker -keyalg RSA -keystore broker.ks
> $ keytool -export -alias broker -keystore broker.ks -file broker_cert
> $ keytool -genkey -alias client -keyalg RSA -keystore client.ks
> $ keytool -import -alias broker -keystore client.ts -file broker_cert
> $ keytool -export -alias client -keystore client.ks -file client_cert
> $ keytool -import -alias client -keystore broker.ts -file client_cert
>
> *I have converted to cert files to pem files using below commands:*
> $ keytool -importkeystore -srckeystore broker.ks -destkeystore
> broker_cert.p12 -srcstoretype jks -deststoretype pkcs12
> $ openssl pkcs12 -in broker_cert.p12 -out Broker.pem
> $ keytool -importkeystore -srckeystore client.ks -destkeystore
> client_cert.p12 -srcstoretype jks -deststoretype pkcs12
> $ openssl pkcs12 -in client_cert.p12 -out Client.pem
>
> is there any thing that i miss? or wrong configuration in client or broker
> side ?
>
> Thanks a lot.
>
>
>
>
>
>
>
>
> --
> View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4674024.html
> Sent from the ActiveMQ - User mailing list archive at Nabble.com.
>
You need to debug the SSL handshake and see what is going on. You may
need to enable other cipher suites etc to allow the broker and client to
communicate.
--
Tim Bish
Sr Software Engineer | RedHat Inc.
tim.bish@redhat.com | www.fusesource.com | www.redhat.com
skype: tabish121 | twitter: @tabish121
blog: http://timbish.blogspot.com/
Re: setting up c++ client app using CMS using SSL client
certificate auth
Posted by darkrwe <em...@gmail.com>.
Hi Tim,
thank you for answer.
I installed oracle JDK7 and now i don't get below problems.
Now I just want to summarize what i do.. Because my pem file is problematic
in client side.
Maybe another configuration i could miss.
> I'm getting below error on the client side (ubuntu 13.04 -same machine
> with
> the client)
> Error occurred while accessing an OpenSSL library method:
> error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal
> error
>
> I'm also getting below error from broker side (ubuntu 13.04 -same machine
> with the client)
> 2013-11-07 12:04:22,244 | ERROR | Could not accept connection from
> tcp://127.0.0.1:55751: javax.net.ssl.SSLException:
> java.security.ProviderException:
> sun.security.pkcs11.wrapper.PKCS11Exception: CKR_DOMAIN_PARAMS_INVALID |
> org.apache.activemq.broker.TransportConnector | ActiveMQ
> BrokerService[localhost] Task-3
*But now I have got the these error from client:*
*Error occurred while accessing an OpenSSL library method:
error:0906D06C:PEM routines:PEM_read_bio:no start line
error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib*
*I use below configuration in my cms client:*
I also enabled SSL in activeMQ.(installed openSSL and added proper prefix to
activeMQ installation)
activemq::library::ActiveMQCPP::initializeLibrary();
decaf::lang::System::setProperty(
"decaf.net.ssl.keyStore","/pathToPem/Client.pem");
decaf::lang::System::setProperty("decaf.net.ssl.keyStorePassword",
"123456");
decaf::lang::System::setProperty( "decaf.net.ssl.trustStore",
"/pathToPem/Broker.pem" );
url ="ssl://localhost:61617";
in broker side i have done below configurations:
*in activemq.xml:*
<sslContext>
<sslContext
keyStore="broker.ks" keyStorePassword="123456"
trustStore="client.ks" trustStorePassword="123456"/>
</sslContext>
<transportConnectors>
<transportConnector name="ssl"
uri="ssl://localhost:61617?needClientAuth=true" />
<transportConnector name="openwire" uri="tcp://0.0.0.0:61616?
maximumConnections=1000&wireformat.maxFrameSize=104857600"/>
<transportConnector name="amqp"
uri="amqp://0.0.0.0:5672?maximumConnections=1000&wireformat.maxFrameSize=104857600"/>
</transportConnectors>
*I also export the SSL_OPTS environment parameter before starting the
broker:*
$ export SSL_OPTS="-Djavax.net.ssl.keyStore=/pathTobrokerks/broker.ks
-Djavax.net.ssl.keyStorePassword=123456
-Djavax.net.ssl.trustStore=/pathTobrokerts/broker.ts"
Below commands for generating keystores and certificates:
$ keytool -genkey -alias broker -keyalg RSA -keystore broker.ks
$ keytool -export -alias broker -keystore broker.ks -file broker_cert
$ keytool -genkey -alias client -keyalg RSA -keystore client.ks
$ keytool -import -alias broker -keystore client.ts -file broker_cert
$ keytool -export -alias client -keystore client.ks -file client_cert
$ keytool -import -alias client -keystore broker.ts -file client_cert
*I have converted to cert files to pem files using below commands:*
$ keytool -importkeystore -srckeystore broker.ks -destkeystore
broker_cert.p12 -srcstoretype jks -deststoretype pkcs12
$ openssl pkcs12 -in broker_cert.p12 -out Broker.pem
$ keytool -importkeystore -srckeystore client.ks -destkeystore
client_cert.p12 -srcstoretype jks -deststoretype pkcs12
$ openssl pkcs12 -in client_cert.p12 -out Client.pem
is there any thing that i miss? or wrong configuration in client or broker
side ?
Thanks a lot.
--
View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4674024.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: setting up c++ client app using CMS using SSL client certificate
auth
Posted by Timothy Bish <ta...@gmail.com>.
On 11/07/2013 05:13 AM, darkrwe wrote:
> Hello guys,
>
> I have same problem too.
>
> I'm getting below error on the client side (ubuntu 13.04 -same machine with
> the client)
> Error occurred while accessing an OpenSSL library method:
> error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal
> error
>
> I'm also getting below error from broker side (ubuntu 13.04 -same machine
> with the client)
> 2013-11-07 12:04:22,244 | ERROR | Could not accept connection from
> tcp://127.0.0.1:55751: javax.net.ssl.SSLException:
> java.security.ProviderException:
> sun.security.pkcs11.wrapper.PKCS11Exception: CKR_DOMAIN_PARAMS_INVALID |
> org.apache.activemq.broker.TransportConnector | ActiveMQ
> BrokerService[localhost] Task-3
>
> I could not figure out how to enabled ssl debug mode ? Can you help me about
> execution below command?
> -Djava.net.debug=ssl
You need to add this to the ACTIVEMQ_OPTS env var or modify your script
that starts the broker to add this to the command line.
>
> and how you solve this problem guys ?
>
> Thank you.
>
>
>
> --
> View this message in context: http://activemq.2283324.n4.nabble.com/setting-up-c-client-app-using-CMS-using-SSL-client-certificate-auth-tp4664686p4673995.html
> Sent from the ActiveMQ - User mailing list archive at Nabble.com.
>
--
Tim Bish
Sr Software Engineer | RedHat Inc.
tim.bish@redhat.com | www.fusesource.com | www.redhat.com
skype: tabish121 | twitter: @tabish121
blog: http://timbish.blogspot.com/