You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "Jul Tomten (Jira)" <ji...@apache.org> on 2021/06/17 10:12:00 UTC
[jira] [Commented] (NIFI-8713) ConsumeJMS and PublishJMS doesn't
work over SSL/TLS PKIX path building failed
[ https://issues.apache.org/jira/browse/NIFI-8713?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17364816#comment-17364816 ]
Jul Tomten commented on NIFI-8713:
----------------------------------
!image-2021-06-17-12-07-32-920.png!
Got it working by setting extra properties. on the JMSConnectionFactoryProvider
property TrustStore
property TrustStorePassword
property TrustStoreType
This is an error as the trust store is already set in the JMS SSL Context Service and its necessary to store the keystore password visible in plain text.
> ConsumeJMS and PublishJMS doesn't work over SSL/TLS PKIX path building failed
> -----------------------------------------------------------------------------
>
> Key: NIFI-8713
> URL: https://issues.apache.org/jira/browse/NIFI-8713
> Project: Apache NiFi
> Issue Type: Bug
> Components: Extensions
> Affects Versions: 1.13.2
> Environment: redhat
> java sap machine 1.11
> activemq-all-5.15.9.jar
> Reporter: Jul Tomten
> Priority: Major
> Labels: ConsumeJMS, PKIX, SSL, TLS, building, failed, path
> Attachments: image-2021-06-16-21-40-53-349.png, image-2021-06-17-12-07-32-920.png
>
>
> ConsumeJMS and PublichJMS doesn't work over SSL/TLS - error message PKIX path building failed
>
> !image-2021-06-16-21-40-53-349.png!
>
> getJMSQueue putJMSQueue works fine with the same jks file and SSL context service.
> invokeHTTP works fine with the same context service.
> I have a root ca that issues the server certificates without intermediate ca.
> In the trust store jks there is only one certificate so it's a very simple setup.
> Is there any extra requirements on the jks trsutstore when using ConsumeJMS or PublishJMS compared to getJMSQueue putJMSQueue ?
>
> The trust store type in the SSL context service seems to not matter if it is set to JKS or PKCS12 .
> ConsumeJMS or PublishJMS fails both with JKS and PKCS12
> getJMSQueue putJMSQueue works with JKS and PKCS12.
>
> java keytool lists my trust store as keystore type PKCS12 provider SUN.
> I have tested with a keystore of type JKS but it fails with the same error message.
>
> activemq-all-5.15.9.jar is used with ConsumeJMS or PublishJMS
> getJMSQueue putJMSQueue uses ActiveMQ driver shipped with NiFi
>
> The activemq-all-5.15.9.jar has been tested in sap po whrere it works fine.
>
> Tested using the JMS* properties on the processor instead of the connection factory service JMS context servive but still the same error message.
> I guess the ConsumeJMS or PublishJMS doesn't use the specified ssl context service but maybe fall back to using jdk cacerts file?
> Tested putting the root ca cert in cacerts file and in the file pointed to by nifi.security.truststore but it is still the same error message.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)