You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@qpid.apache.org by Steven <mg...@tibco-support.com> on 2016/05/24 02:37:46 UTC
connect Qpid broker using the latest amqp 1.0 qpid-jms-client-0.9
ssl
Hello,every one,
I was using the latest amqp 1.0 api to connect to broker ssl,The connection
url is
connectionfactory.qpidConnectionfactory =
amqps://192.168.82.57:5673?transport.trustStoreLocation=F:\\AMQP\\QpidSSL\\clientts.jks&transport.trustStorePassword=123456
it reported the following error:
javax.naming.NamingException: Exception while creating ConnectionFactory
'qpidConnectionfactory'. [Root exception is
java.lang.IllegalArgumentException: Invalid remote URI:
amqps://192.168.82.57:5673?transport.trustStoreLocation=F:\AMQP\QpidSSL\clientts.jks&transport.trustStorePassword=123456]
at
org.apache.qpid.jms.jndi.JmsInitialContextFactory.createConnectionFactories(JmsInitialContextFactory.java:151)
at
org.apache.qpid.jms.jndi.JmsInitialContextFactory.getInitialContext(JmsInitialContextFactory.java:114)
at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
at javax.naming.InitialContext.init(Unknown Source)
at javax.naming.InitialContext.<init>(Unknown Source)
at org.apache.qpid.jms.example.HelloWorld.getContext(HelloWorld.java:55)
at org.apache.qpid.jms.example.HelloWorld.test(HelloWorld.java:84)
at org.apache.qpid.jms.example.HelloWorld.main(HelloWorld.java:73)
Caused by: java.lang.IllegalArgumentException: Invalid remote URI:
amqps://192.168.82.57:5673?transport.trustStoreLocation=F:\AMQP\QpidSSL\clientts.jks&transport.trustStorePassword=123456
at
org.apache.qpid.jms.JmsConnectionFactory.createURI(JmsConnectionFactory.java:244)
at
org.apache.qpid.jms.JmsConnectionFactory.setRemoteURI(JmsConnectionFactory.java:284)
at
org.apache.qpid.jms.JmsConnectionFactory.buildFromProperties(JmsConnectionFactory.java:126)
at
org.apache.qpid.jms.jndi.JNDIStorable.setProperties(JNDIStorable.java:64)
at
org.apache.qpid.jms.jndi.JmsInitialContextFactory.createConnectionFactory(JmsInitialContextFactory.java:282)
at
org.apache.qpid.jms.jndi.JmsInitialContextFactory.createConnectionFactory(JmsInitialContextFactory.java:186)
at
org.apache.qpid.jms.jndi.JmsInitialContextFactory.createConnectionFactories(JmsInitialContextFactory.java:149)
... 8 more
Caused by: java.net.URISyntaxException: Illegal character in query at index
58:
amqps://192.168.82.57:5673?transport.trustStoreLocation=F:\AMQP\QpidSSL\clientts.jks&transport.trustStorePassword=123456
at java.net.URI$Parser.fail(Unknown Source)
at java.net.URI$Parser.checkChars(Unknown Source)
at java.net.URI$Parser.parseHierarchical(Unknown Source)
at java.net.URI$Parser.parse(Unknown Source)
at java.net.URI.<init>(Unknown Source)
at
org.apache.qpid.jms.JmsConnectionFactory.createURI(JmsConnectionFactory.java:242)
... 14 more
Caught exception, exiting.
java.lang.NullPointerException
at org.apache.qpid.jms.example.HelloWorld.test(HelloWorld.java:86)
at org.apache.qpid.jms.example.HelloWorld.main(HelloWorld.java:73)
I also try the following connection url:
connectionfactory.qpidConnectionfactory =
amqps://192.168.82.57:5673?transport.trustStoreLocation=F:/AMQP/QpidSSL/clientts.jks&transport.trustStorePassword=123456
It reported the following error:
2016-05-24 10:35:01,860 [main ] - ERROR JmsConnectionFactory
- Failed to create JMS Provider instance for: amqps
Caught exception, exiting.
javax.jms.JMSException: Failed to create connection to:
amqps://192.168.82.57:5673?transport.trustStoreLocation=F%253A%252FAMQP%252FQpidSSL%252Fclientts.jks&transport.trustStorePassword=123456
at
org.apache.qpid.jms.exceptions.JmsExceptionSupport.create(JmsExceptionSupport.java:66)
at
org.apache.qpid.jms.JmsConnectionFactory.createConnection(JmsConnectionFactory.java:172)
at
org.apache.qpid.jms.JmsConnectionFactory.createConnection(JmsConnectionFactory.java:161)
at org.apache.qpid.jms.example.HelloWorld.test(HelloWorld.java:91)
at org.apache.qpid.jms.example.HelloWorld.main(HelloWorld.java:73)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Handshaker.checkThrown(Unknown Source)
at sun.security.ssl.SSLEngineImpl.checkTaskThrown(Unknown Source)
at sun.security.ssl.SSLEngineImpl.readNetRecord(Unknown Source)
at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source)
at javax.net.ssl.SSLEngine.unwrap(Unknown Source)
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:927)
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:871)
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:827)
at
io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:228)
at
io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:141)
at
io.netty.channel.DefaultChannelHandlerContext.invokeChannelRead(DefaultChannelHandlerContext.java:340)
at
io.netty.channel.DefaultChannelHandlerContext.fireChannelRead(DefaultChannelHandlerContext.java:326)
at
io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:785)
at
io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:116)
at
io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:494)
at
io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:461)
at
io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:378)
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:350)
at
io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:101)
at java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
at sun.security.ssl.Handshaker.processLoop(Unknown Source)
at sun.security.ssl.Handshaker$1.run(Unknown Source)
at sun.security.ssl.Handshaker$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.ssl.Handshaker$DelegatedTask.run(Unknown Source)
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:960)
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:891)
... 13 more
Caused by: java.security.cert.CertificateException: No subject alternative
names present
at sun.security.util.HostnameChecker.matchIP(Unknown Source)
at sun.security.util.HostnameChecker.match(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
... 22 more
I can through other means to connect broker successfully(qpid-0.32 api),This
proved the certificate is fine.Could anyone help me look into this
issue.Thanks in Advance
--
View this message in context: http://qpid.2158936.n2.nabble.com/connect-Qpid-broker-using-the-latest-amqp-1-0-qpid-jms-client-0-9-ssl-tp7644406.html
Sent from the Apache Qpid users mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: connect Qpid broker using the latest amqp 1.0 qpid-jms-client-0.9
ssl
Posted by Gordon Sim <gs...@redhat.com>.
On 25/05/16 11:14, Steven wrote:
> Caused by: java.security.cert.CertificateException: No name matching
> QpidServer found
> at sun.security.util.HostnameChecker.matchDNS(Unknown Source)
> at sun.security.util.HostnameChecker.match(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
> ... 22 more
> but,I use the tcp to communicate with server,It can send message
> successfully.The connection URL:
> connectionfactory.qpidConnectionfactory =
> amqp://QpidServer:5672?jms.username=admin&jms.password=admin&transport.connectTimeout=30000
What is the hostname in your brokers certificate? Is it fully qualified
with a domain name? You need to use the same name in your url.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: connect Qpid broker using the latest amqp 1.0
qpid-jms-client-0.9 ssl
Posted by Steven <mg...@tibco-support.com>.
Hello,Robbie Gemmell
Thank you very much,According to your suggestion,I re-generated certificate
with the issue organization 's name "stevenGu",Which is the same name with
Qpid Server name.upload my broker trustore file and broker keystore file
into Qpid Server.add a new port 5674 pointed for trustore file and keystore.
use the new-generate certificate
connectionfactory.qpidConnectionfactory =
amqps://stevenGu:5674?jms.username=admin&jms.password=admin&transport.trustStoreLocation=E:/QpidSSL/clientts.jks&transport.trustStorePassword=123456
It can send message to Qpid Server successfully.
Thank you very much
--
View this message in context: http://qpid.2158936.n2.nabble.com/connect-Qpid-broker-using-the-latest-amqp-1-0-qpid-jms-client-0-9-ssl-tp7644406p7644600.html
Sent from the Apache Qpid users mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: connect Qpid broker using the latest amqp 1.0 qpid-jms-client-0.9 ssl
Posted by Robbie Gemmell <ro...@gmail.com>.
On 25 May 2016 at 11:14, Steven <mg...@tibco-support.com> wrote:
> Hello,Robbie Gemmell
>
> This time I try to use hostname rather than IP address,Below is my
> connection URL:
> connectionfactory.qpidConnectionfactory =
> amqps://QpidServer:5673?transport.trustStoreLocation=F:/AMQP/QpidSSL/clientts.jks&transport.trustStorePassword=123456
>
> It still reported the following error:
> at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source)
> at javax.net.ssl.SSLEngine.unwrap(Unknown Source)
> at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:927)
> at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:871)
> at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:827)
> at
> io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:228)
> at
> io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:141)
> at
> io.netty.channel.DefaultChannelHandlerContext.invokeChannelRead(DefaultChannelHandlerContext.java:340)
> at
> io.netty.channel.DefaultChannelHandlerContext.fireChannelRead(DefaultChannelHandlerContext.java:326)
> at
> io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:785)
> at
> io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:116)
> at
> io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:494)
> at
> io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:461)
> at
> io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:378)
> at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:350)
> at
> io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:101)
> at java.lang.Thread.run(Unknown Source)
> Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
> at sun.security.ssl.Alerts.getSSLException(Unknown Source)
> at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source)
> at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
> at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
> at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
> at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
> at sun.security.ssl.Handshaker.processLoop(Unknown Source)
> at sun.security.ssl.Handshaker$1.run(Unknown Source)
> at sun.security.ssl.Handshaker$1.run(Unknown Source)
> at java.security.AccessController.doPrivileged(Native Method)
> at sun.security.ssl.Handshaker$DelegatedTask.run(Unknown Source)
> at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:960)
> at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:891)
> ... 13 more
> Caused by: java.security.cert.CertificateException: No name matching
> QpidServer found
> at sun.security.util.HostnameChecker.matchDNS(Unknown Source)
> at sun.security.util.HostnameChecker.match(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
> ... 22 more
> but,I use the tcp to communicate with server,It can send message
> successfully.The connection URL:
> connectionfactory.qpidConnectionfactory =
> amqp://QpidServer:5672?jms.username=admin&jms.password=admin&transport.connectTimeout=30000
>
> I used the same truststore file and trustStorePassword with
> qpid-amqp-1.0-client-0.32,It can connect to broker successfully.By the way,I
> notice the connection factory SSL API changed between
> qpid-amqp-1.0-client-0.32 and qpid-jms-0.9.0
>
> In qpid-amqp-1.0-client-0.32 client API:
> As you can see the below screenshot:
> <http://qpid.2158936.n2.nabble.com/file/n7644530/ssl.png>
> but the qpid-jms-0.9.0 connection factory didn't have the corresponding
> method.
> org.apache.qpid.jms.JmsConnectionFactory,It didn't have setSSL and
> setSSLContext method.
>
>
That is correct, the new client does not have those methods, SSL is
configured via the URI and if desired the standard javax.net.ssl
system properties.
As Gordon mentioned, you need to use a value for the URI hostname that
your server certificate is presenting, otherwise the certificate
hostname verification process will fail. Presumably your servers
certificate is not presenting itself as "QpidServer" like you are
connecting to, hence the exception you see.
The new client performs hostname verification by default and so your
client+server configuration must support that occurring (i.e matching
connect hostname and server certificate names), or else it would need
disabled which is obviously not recommended.
>
> --
> View this message in context: http://qpid.2158936.n2.nabble.com/connect-Qpid-broker-using-the-latest-amqp-1-0-qpid-jms-client-0-9-ssl-tp7644406p7644530.html
> Sent from the Apache Qpid users mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: connect Qpid broker using the latest amqp 1.0
qpid-jms-client-0.9 ssl
Posted by Steven <mg...@tibco-support.com>.
Hello,Robbie Gemmell
This time I try to use hostname rather than IP address,Below is my
connection URL:
connectionfactory.qpidConnectionfactory =
amqps://QpidServer:5673?transport.trustStoreLocation=F:/AMQP/QpidSSL/clientts.jks&transport.trustStorePassword=123456
It still reported the following error:
at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source)
at javax.net.ssl.SSLEngine.unwrap(Unknown Source)
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:927)
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:871)
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:827)
at
io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:228)
at
io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:141)
at
io.netty.channel.DefaultChannelHandlerContext.invokeChannelRead(DefaultChannelHandlerContext.java:340)
at
io.netty.channel.DefaultChannelHandlerContext.fireChannelRead(DefaultChannelHandlerContext.java:326)
at
io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:785)
at
io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:116)
at
io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:494)
at
io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:461)
at
io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:378)
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:350)
at
io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:101)
at java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
at sun.security.ssl.Handshaker.processLoop(Unknown Source)
at sun.security.ssl.Handshaker$1.run(Unknown Source)
at sun.security.ssl.Handshaker$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.ssl.Handshaker$DelegatedTask.run(Unknown Source)
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:960)
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:891)
... 13 more
Caused by: java.security.cert.CertificateException: No name matching
QpidServer found
at sun.security.util.HostnameChecker.matchDNS(Unknown Source)
at sun.security.util.HostnameChecker.match(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
... 22 more
but,I use the tcp to communicate with server,It can send message
successfully.The connection URL:
connectionfactory.qpidConnectionfactory =
amqp://QpidServer:5672?jms.username=admin&jms.password=admin&transport.connectTimeout=30000
I used the same truststore file and trustStorePassword with
qpid-amqp-1.0-client-0.32,It can connect to broker successfully.By the way,I
notice the connection factory SSL API changed between
qpid-amqp-1.0-client-0.32 and qpid-jms-0.9.0
In qpid-amqp-1.0-client-0.32 client API:
As you can see the below screenshot:
<http://qpid.2158936.n2.nabble.com/file/n7644530/ssl.png>
but the qpid-jms-0.9.0 connection factory didn't have the corresponding
method.
org.apache.qpid.jms.JmsConnectionFactory,It didn't have setSSL and
setSSLContext method.
--
View this message in context: http://qpid.2158936.n2.nabble.com/connect-Qpid-broker-using-the-latest-amqp-1-0-qpid-jms-client-0-9-ssl-tp7644406p7644530.html
Sent from the Apache Qpid users mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: connect Qpid broker using the latest amqp 1.0 qpid-jms-client-0.9 ssl
Posted by Robbie Gemmell <ro...@gmail.com>.
On 24 May 2016 at 09:26, Gordon Sim <gs...@redhat.com> wrote:
> On 24/05/16 03:37, Steven wrote:
>>
>> Hello,every one,
>>
>> I was using the latest amqp 1.0 api to connect to broker ssl,The
>> connection
>> url is
>> connectionfactory.qpidConnectionfactory =
>>
>> amqps://192.168.82.57:5673?transport.trustStoreLocation=F:\\AMQP\\QpidSSL\\clientts.jks&transport.trustStorePassword=123456
>>
>> it reported the following error:
>> javax.naming.NamingException: Exception while creating ConnectionFactory
>> 'qpidConnectionfactory'. [Root exception is
>> java.lang.IllegalArgumentException: Invalid remote URI:
>>
>> amqps://192.168.82.57:5673?transport.trustStoreLocation=F:\AMQP\QpidSSL\clientts.jks&transport.trustStorePassword=123456]
>
>
> My guess would be an issue with the backslash character.
>
Yes, I mentioned this yesterday on QPID-7275. The below proves that
the backslash is the problem, as after changing it the URI then worked
but a new issue occurs later in the connection process.
> [...]
>>
>> I also try the following connection url:
>> connectionfactory.qpidConnectionfactory =
>>
>> amqps://192.168.82.57:5673?transport.trustStoreLocation=F:/AMQP/QpidSSL/clientts.jks&transport.trustStorePassword=123456
>>
>> It reported the following error:
>> 2016-05-24 10:35:01,860 [main ] - ERROR JmsConnectionFactory
>> - Failed to create JMS Provider instance for: amqps
>> Caught exception, exiting.
>> javax.jms.JMSException: Failed to create connection to:
>>
>> amqps://192.168.82.57:5673?transport.trustStoreLocation=F%253A%252FAMQP%252FQpidSSL%252Fclientts.jks&transport.trustStorePassword=123456
>
> [...]
>
> This one looks like it may be related to hostname verification. You are
> connecting by IP address. What is the CN of your certificate? Is it a
> hostname? Does using the hostname as in the certificate work?
As Gordon mentioned, the stacktrace looks to show a failure during
server identity verification, seemingly with the IP address you are
using as the 'hostname' to connect to not aligning with the identity
of the certificate received from the server.
You likely need to use the appropriate hostname rather than IP (so
amqps://serverhost...etc..) when connecting, or update your presumably
test-only certificates, or disable the hostname verification (which
would obviously not be the preferred route).
>
>> Caused by: java.security.cert.CertificateException: No subject alternative
>> names present
>> at sun.security.util.HostnameChecker.matchIP(Unknown Source)
>> at sun.security.util.HostnameChecker.match(Unknown Source)
>> at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown
>> Source)
>> at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown
>> Source)
>> at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown
>> Source)
>> at
>> sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
>> ... 22 more
>>
>> I can through other means to connect broker successfully(qpid-0.32
>> api),This
>> proved the certificate is fine.Could anyone help me look into this
>> issue.Thanks in Advance
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: connect Qpid broker using the latest amqp 1.0 qpid-jms-client-0.9
ssl
Posted by Gordon Sim <gs...@redhat.com>.
On 24/05/16 03:37, Steven wrote:
> Hello,every one,
>
> I was using the latest amqp 1.0 api to connect to broker ssl,The connection
> url is
> connectionfactory.qpidConnectionfactory =
> amqps://192.168.82.57:5673?transport.trustStoreLocation=F:\\AMQP\\QpidSSL\\clientts.jks&transport.trustStorePassword=123456
>
> it reported the following error:
> javax.naming.NamingException: Exception while creating ConnectionFactory
> 'qpidConnectionfactory'. [Root exception is
> java.lang.IllegalArgumentException: Invalid remote URI:
> amqps://192.168.82.57:5673?transport.trustStoreLocation=F:\AMQP\QpidSSL\clientts.jks&transport.trustStorePassword=123456]
My guess would be an issue with the backslash character.
[...]
> I also try the following connection url:
> connectionfactory.qpidConnectionfactory =
> amqps://192.168.82.57:5673?transport.trustStoreLocation=F:/AMQP/QpidSSL/clientts.jks&transport.trustStorePassword=123456
>
> It reported the following error:
> 2016-05-24 10:35:01,860 [main ] - ERROR JmsConnectionFactory
> - Failed to create JMS Provider instance for: amqps
> Caught exception, exiting.
> javax.jms.JMSException: Failed to create connection to:
> amqps://192.168.82.57:5673?transport.trustStoreLocation=F%253A%252FAMQP%252FQpidSSL%252Fclientts.jks&transport.trustStorePassword=123456
[...]
This one looks like it may be related to hostname verification. You are
connecting by IP address. What is the CN of your certificate? Is it a
hostname? Does using the hostname as in the certificate work?
> Caused by: java.security.cert.CertificateException: No subject alternative
> names present
> at sun.security.util.HostnameChecker.matchIP(Unknown Source)
> at sun.security.util.HostnameChecker.match(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
> ... 22 more
>
> I can through other means to connect broker successfully(qpid-0.32 api),This
> proved the certificate is fine.Could anyone help me look into this
> issue.Thanks in Advance
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org