You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@qpid.apache.org by cgh467 <xl...@yahoo.com.INVALID> on 2020/08/20 22:32:12 UTC
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Hi,
I ran into the same issue now. When I run qpid C++ client to connect
remote Java sever, I got below error:
2020-08-20 18:25:33 [System] debug Exception constructed: Failed: Cannot
communicate securely with peer: no common encryption algorithm(s). [-12286]
(/development/fxgtla/qpid/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
2020-08-20 18:25:33 [Security] warning Connect failed: Failed: Cannot
communicate securely with peer: no common encryption algorithm(s). [-12286]
(/development/fxgtla/qpid/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
2020-08-20 18:25:33 [Client] debug Connection closed
However, I was able to connect to remote server with openssl as below:
openssl s_client -connect lab4.engineering:5673 -tls1_2
Is there any way to force cpp client to use TLSv1.2/TLSv1.1?
Thanks
Linda
--
Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Robbie Gemmell <ro...@gmail.com>.
The output shows that the server offered SCRAM-SHA-256 and PLAIN
mechs. Do you have the relevant cyrus-sasl mechanism modules installed
(e.g cyrus-sasl-plain) to support them? Are you setting the necessary
username and password?
The server did not offer EXTERNAL so it isn't required (or you
wouldn't have got the output shown). Whether it supports it or not,
your configuring the client for EXTERNAL certainly wouldn't work
unless you also provided a client-certificate for the server to
authenticate it using, which you dont appear to (and if you did, and
the server still didnt offer EXTERNAL, that would indicate it isn't
enabled for that at all).
On Thu, 10 Sep 2020 at 18:30, cgh467 <xl...@yahoo.com.invalid> wrote:
>
> Hi Gordon,
>
> Thanks for your suggestion. By setting
> ssl_ignore_hostname_verification_failure=true, I'm able to see some data
> from JAVA server, now the error becomes "Can't authenticate using
> SCRAM-SHA-256 PLAIN" as below trace. Do I miss something? I tried "PLAIN" or
> "EXTERNAL", did not work either.
>
> 2020-09-10 10:23:44 [Client] debug RECV
> [[10.80.244.84:43344-test_lab4.engineering:5673]]: INIT(0-10)
> 2020-09-10 10:23:44 [Security] trace RECV
> [[10.80.244.84:43344-test_lab4.engineering:5673]]: Frame[BEbe; channel=0;
> {ConnectionStartBody: server-properties={product:V2:25:str16(Apache Qpid
> Broker-J
> Core),qpid.build:V2:40:str16(5ffa4c35f62c4bcdc3cfd507a2c1e7cf36a49547),qpid.features:[{V2:17:str16(qpid.jms-selector)}]list([{V2:17:str16(qpid.jms-selector)}]),qpid.federation_tag:V2:36:str16(0892b38e-e400-4bec-a2da-28c5bf664a2e),qpid.instance_name:V2:6:str16(Broker),qpid.message_compression_supported:V2:4:str16(true),qpid.queue_lifetime_supported:V2:4:str16(true),qpid.virtualhost_properties_supported:V2:4:str16(true),version:V2:5:str16(7.1.7)};
> mechanisms=str16{V2:13:str16(SCRAM-SHA-256), V2:5:str16(PLAIN)};
> locales=str16{V2:5:str16(en_US)}; }]
> 2020-09-10 10:23:44 [Security] debug CyrusSasl::start(SCRAM-SHA-256 PLAIN)
> 2020-09-10 10:23:44 [Security] debug external SSF detected and set to 128
> 2020-09-10 10:23:44 [Security] debug min_ssf: 0, max_ssf: 256
> 2020-09-10 10:23:44 [System] debug Exception constructed: Can't authenticate
> using SCRAM-SHA-256 PLAIN
> 2020-09-10 10:23:44 [Client] warning Closing connection due to Can't
> authenticate using SCRAM-SHA-256 PLAIN
>
> Thanks so much!
> Linda
>
>
>
>
>
>
> --
> Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Gordon Sim <gs...@redhat.com>.
On 18/09/2020 4:18 pm, cgh467 wrote:
> update status--
>
> I did following things on ubuntu12.04:
> 1). rebuilt the qpid-cpp 1.39 and qpid-proton C++ source and install
> 2). upgraded the libnspr4* from 4.8 to 4.12
> 3). upgraded the libnss3* from 3.13 to 3.26.2
>
> Now, I'm able to make connection to remote JAVA server. The system seems not
> that stable, I will need to figure out later. Anyway, I can continue my
> work.
Glad you finally got it working! Thanks for the update.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by cgh467 <xl...@yahoo.com.INVALID>.
update status--
I did following things on ubuntu12.04:
1). rebuilt the qpid-cpp 1.39 and qpid-proton C++ source and install
2). upgraded the libnspr4* from 4.8 to 4.12
3). upgraded the libnss3* from 3.13 to 3.26.2
Now, I'm able to make connection to remote JAVA server. The system seems not
that stable, I will need to figure out later. Anyway, I can continue my
work.
Thanks Gordon and Robbie for the great help, really appreciate!
Linda
--
Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Gordon Sim <gs...@redhat.com>.
On 11/09/2020 8:37 pm, cgh467 wrote:
> Hi Gordon,
>
> I just worked with server group to put the username and password, it
> works now. I'm able to make connection to the remote JAVA server. So the
> error is related to the username and password, thank you for pointing out.
> Since it works with Ubuntu18.04, means the certs are good. I need to figure
> out how to make TLS working on ubuntu12.04. The error on Ubuntu12.04 is "no
> common encryption algorithm".
As Robbie suggested earlier in the thread it is most likely the version
of NSS you have on that box.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by cgh467 <xl...@yahoo.com.INVALID>.
Hi Gordon,
I just worked with server group to put the username and password, it
works now. I'm able to make connection to the remote JAVA server. So the
error is related to the username and password, thank you for pointing out.
Since it works with Ubuntu18.04, means the certs are good. I need to figure
out how to make TLS working on ubuntu12.04. The error on Ubuntu12.04 is "no
common encryption algorithm".
Thanks so much!
Linda
--
Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Gordon Sim <gs...@redhat.com>.
On 11/09/2020 6:55 pm, cgh467 wrote:
> Hi Gordon,
>
> I checked with server group. There is no username/password required for
> port5673.
The broker is only offering PLAIN and SCRAM-SHA-256 both of which
require a username and password. If you are expected to supply a client
certificate they would need to give you one and also enable EXTERNAL.
> Can you tell me which plug-in required for SCRAM-SHA-256 PLAIN? I
> installed some packages from this
> link(https://packages.ubuntu.com/source/bionic/cyrus-sasl2). Could not
> figure out which one is for SCRAM-SHA-256 PLAIN.
On fedora they are installed under /usr/lib64/sasl2/ libplain.so and
libscram.so
> By the way, do you know if webscoket is supporting in qpid C++ client on
> Ubuntu?
No, it is not.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by cgh467 <xl...@yahoo.com.INVALID>.
Hi Gordon,
I checked with server group. There is no username/password required for
port5673. Can you tell me which plug-in required for SCRAM-SHA-256 PLAIN? I
installed some packages from this
link(https://packages.ubuntu.com/source/bionic/cyrus-sasl2). Could not
figure out which one is for SCRAM-SHA-256 PLAIN.
By the way, do you know if webscoket is supporting in qpid C++ client on
Ubuntu?
Thanks so much!
Linda
--
Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Gordon Sim <gs...@redhat.com>.
On 10/09/2020 6:30 pm, cgh467 wrote:
> Hi Gordon,
>
> Thanks for your suggestion. By setting
> ssl_ignore_hostname_verification_failure=true, I'm able to see some data
> from JAVA server, now the error becomes "Can't authenticate using
> SCRAM-SHA-256 PLAIN" as below trace. Do I miss something? I tried "PLAIN" or
> "EXTERNAL", did not work either.
>
> 2020-09-10 10:23:44 [Client] debug RECV
> [[10.80.244.84:43344-test_lab4.engineering:5673]]: INIT(0-10)
> 2020-09-10 10:23:44 [Security] trace RECV
> [[10.80.244.84:43344-test_lab4.engineering:5673]]: Frame[BEbe; channel=0;
> {ConnectionStartBody: server-properties={product:V2:25:str16(Apache Qpid
> Broker-J
> Core),qpid.build:V2:40:str16(5ffa4c35f62c4bcdc3cfd507a2c1e7cf36a49547),qpid.features:[{V2:17:str16(qpid.jms-selector)}]list([{V2:17:str16(qpid.jms-selector)}]),qpid.federation_tag:V2:36:str16(0892b38e-e400-4bec-a2da-28c5bf664a2e),qpid.instance_name:V2:6:str16(Broker),qpid.message_compression_supported:V2:4:str16(true),qpid.queue_lifetime_supported:V2:4:str16(true),qpid.virtualhost_properties_supported:V2:4:str16(true),version:V2:5:str16(7.1.7)};
> mechanisms=str16{V2:13:str16(SCRAM-SHA-256), V2:5:str16(PLAIN)};
> locales=str16{V2:5:str16(en_US)}; }]
> 2020-09-10 10:23:44 [Security] debug CyrusSasl::start(SCRAM-SHA-256 PLAIN)
> 2020-09-10 10:23:44 [Security] debug external SSF detected and set to 128
> 2020-09-10 10:23:44 [Security] debug min_ssf: 0, max_ssf: 256
> 2020-09-10 10:23:44 [System] debug Exception constructed: Can't authenticate
> using SCRAM-SHA-256 PLAIN
> 2020-09-10 10:23:44 [Client] warning Closing connection due to Can't
> authenticate using SCRAM-SHA-256 PLAIN
Did you specify a username and password? Do you have the cyrus sasl
plugins installed for PLAIN and SCRAM-SHA-256?
To use EXTERNAL you would need to provide a client certificate and the
broker would need to be configured to allow it.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by cgh467 <xl...@yahoo.com.INVALID>.
Hi Gordon,
Thanks for your suggestion. By setting
ssl_ignore_hostname_verification_failure=true, I'm able to see some data
from JAVA server, now the error becomes "Can't authenticate using
SCRAM-SHA-256 PLAIN" as below trace. Do I miss something? I tried "PLAIN" or
"EXTERNAL", did not work either.
2020-09-10 10:23:44 [Client] debug RECV
[[10.80.244.84:43344-test_lab4.engineering:5673]]: INIT(0-10)
2020-09-10 10:23:44 [Security] trace RECV
[[10.80.244.84:43344-test_lab4.engineering:5673]]: Frame[BEbe; channel=0;
{ConnectionStartBody: server-properties={product:V2:25:str16(Apache Qpid
Broker-J
Core),qpid.build:V2:40:str16(5ffa4c35f62c4bcdc3cfd507a2c1e7cf36a49547),qpid.features:[{V2:17:str16(qpid.jms-selector)}]list([{V2:17:str16(qpid.jms-selector)}]),qpid.federation_tag:V2:36:str16(0892b38e-e400-4bec-a2da-28c5bf664a2e),qpid.instance_name:V2:6:str16(Broker),qpid.message_compression_supported:V2:4:str16(true),qpid.queue_lifetime_supported:V2:4:str16(true),qpid.virtualhost_properties_supported:V2:4:str16(true),version:V2:5:str16(7.1.7)};
mechanisms=str16{V2:13:str16(SCRAM-SHA-256), V2:5:str16(PLAIN)};
locales=str16{V2:5:str16(en_US)}; }]
2020-09-10 10:23:44 [Security] debug CyrusSasl::start(SCRAM-SHA-256 PLAIN)
2020-09-10 10:23:44 [Security] debug external SSF detected and set to 128
2020-09-10 10:23:44 [Security] debug min_ssf: 0, max_ssf: 256
2020-09-10 10:23:44 [System] debug Exception constructed: Can't authenticate
using SCRAM-SHA-256 PLAIN
2020-09-10 10:23:44 [Client] warning Closing connection due to Can't
authenticate using SCRAM-SHA-256 PLAIN
Thanks so much!
Linda
--
Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Gordon Sim <gs...@redhat.com>.
On 10/09/2020 2:46 pm, cgh467 wrote:
> Hi Robbie,
>
> Thanks for pointing out. I did use the wrong port (5671 is for localhost
> test, 5673 is for remote JAVA server). I change the port to 5673, now I'm
> getting below error. I got both CA and server certs from server group and
> imported into NSS DB. Do I need to configure something on my side to make
> the domain name match? OR something wrong on the certs they gave to me? By
> the way, they did not give me the private key though.
>
> 2020-09-10 06:27:38 [Security] debug SslConnector created for 0-10
> 2020-09-10 06:27:39 [System] info Connecting: 10.44.221.115:5673
> 2020-09-10 06:27:39 [System] debug Exception constructed: Failed: Unable to
> communicate securely with peer: requested domain name does not match the
> server's certificate. [-12276]
> (/build/qpid-cpp-VLEObV/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
> 2020-09-10 06:27:39 [Security] warning Connect failed: Failed: Unable to
> communicate securely with peer: requested domain name does not match the
> server's certificate. [-12276]
> (/build/qpid-cpp-VLEObV/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
> 2020-09-10 06:27:39 [Client] debug Connection closed
As the error indicates the hostname by which you are connecting to the
broker does not match the name the broker's certificate was issued with.
You can specify ssl_ignore_hostname_verification_failure=true in the
connection options in order to ignore that, or else if possible use the
hostname in the certificate.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by cgh467 <xl...@yahoo.com.INVALID>.
Hi Robbie,
Thanks for pointing out. I did use the wrong port (5671 is for localhost
test, 5673 is for remote JAVA server). I change the port to 5673, now I'm
getting below error. I got both CA and server certs from server group and
imported into NSS DB. Do I need to configure something on my side to make
the domain name match? OR something wrong on the certs they gave to me? By
the way, they did not give me the private key though.
2020-09-10 06:27:38 [Security] debug SslConnector created for 0-10
2020-09-10 06:27:39 [System] info Connecting: 10.44.221.115:5673
2020-09-10 06:27:39 [System] debug Exception constructed: Failed: Unable to
communicate securely with peer: requested domain name does not match the
server's certificate. [-12276]
(/build/qpid-cpp-VLEObV/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
2020-09-10 06:27:39 [Security] warning Connect failed: Failed: Unable to
communicate securely with peer: requested domain name does not match the
server's certificate. [-12276]
(/build/qpid-cpp-VLEObV/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
2020-09-10 06:27:39 [Client] debug Connection closed
Thanks a lot!
Linda
--
Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Robbie Gemmell <ro...@gmail.com>.
No, that suggests an issue establishing a TCP connection, with the
connection being refused. Are you using the correct host details? The
error below says you were using port 5671, while your previous mails
all showed connection to port 5673 for example.
On Thu, 10 Sep 2020 at 02:02, cgh467 <xl...@yahoo.com.invalid> wrote:
>
> Hi Robbie,
> I finally get Virtual ubuntu18.04 running with VPN. I run the qpid
> client on this OS, I got the different error message as below: (it said
> connection refused instead of TLS1.2 algorithm issue)
>
> 2020-09-09 17:44:37 [Messaging] debug Trying versions amqp0-10, amqp1.0
> 2020-09-09 17:44:37 [Client] debug Starting connection,
> urls=[amqp:ssl:test_lab4.engineering:5671]
> 2020-09-09 17:44:37 [Client] info Trying to connect to
> amqp:ssl:test_lab4.engineering:5671...
> 2020-09-09 17:44:37 [Client] debug Created IO thread: 0
> 2020-09-09 17:44:37 [Security] debug SslConnector created for 0-10
> 2020-09-09 17:44:37 [System] info Connecting: 10.44.221.115:5671
> 2020-09-09 17:44:37 [Security] warning Connect failed: Connection refused
> 2020-09-09 17:44:37 [Client] debug Connection closed
> 2020-09-09 17:44:37 [System] debug Exception constructed: Connection closed
> 2020-09-09 17:44:37 [Client] info Failed to connect to
> amqp:ssl:test_lab4.engineering:5671: Connection closed
> Failed to connect (reconnect disabled)
>
> -----------------------------
> The NSS DB is as below:
> Certificate Nickname Trust Attributes
> SSL,S/MIME,JAR/XPI
>
> ca-savannacert CT,,
> test_lab4.engineering P,,
>
> Does it mean something wrong with the certificates?
> Thanks so much,
> Linda
>
>
>
>
>
> --
> Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by cgh467 <xl...@yahoo.com.INVALID>.
Hi Robbie,
I finally get Virtual ubuntu18.04 running with VPN. I run the qpid
client on this OS, I got the different error message as below: (it said
connection refused instead of TLS1.2 algorithm issue)
2020-09-09 17:44:37 [Messaging] debug Trying versions amqp0-10, amqp1.0
2020-09-09 17:44:37 [Client] debug Starting connection,
urls=[amqp:ssl:test_lab4.engineering:5671]
2020-09-09 17:44:37 [Client] info Trying to connect to
amqp:ssl:test_lab4.engineering:5671...
2020-09-09 17:44:37 [Client] debug Created IO thread: 0
2020-09-09 17:44:37 [Security] debug SslConnector created for 0-10
2020-09-09 17:44:37 [System] info Connecting: 10.44.221.115:5671
2020-09-09 17:44:37 [Security] warning Connect failed: Connection refused
2020-09-09 17:44:37 [Client] debug Connection closed
2020-09-09 17:44:37 [System] debug Exception constructed: Connection closed
2020-09-09 17:44:37 [Client] info Failed to connect to
amqp:ssl:test_lab4.engineering:5671: Connection closed
Failed to connect (reconnect disabled)
-----------------------------
The NSS DB is as below:
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
ca-savannacert CT,,
test_lab4.engineering P,,
Does it mean something wrong with the certificates?
Thanks so much,
Linda
--
Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Robbie Gemmell <ro...@gmail.com>.
If the issue is that on your old client system the cpp client isnt
using TLS 1.2 and that is required by your remote Broker-J instance,
it seems fairly likely that your local CPP broker wouldn't use it
either or in any case would accept what the client is using given they
both use the same codebase and NSS, meaning the local test against the
entirely different broker doesn't necessarily help all that much.
I'd again suggest updating NSS and its tools to see if that helps. If
not, I would try things out on a newer OS (on another system if need
be) simply as comparison to verify whether you can get things working
there (against the remote Broker-J) with your existing certdb and a
more up to date NSS etc.
On Fri, 28 Aug 2020 at 19:11, cgh467 <xl...@yahoo.com.invalid> wrote:
>
> On device localhost, I was using "qpidd --transport ssl --ssl-port 5673
> --ssl-cert-db database --ssl-cert-password-file........." as broker. Then
> run my qpid c++ ssl client. It worked. The device has limited memory, could
> not install java. The remote is qpid java server.
> By the way, I tried to run "qpid-stat -q -b" with remote URL on the device.
> it reported ConnectionError too. Even with openssl, I have to give specific
> "-tls1_2" option to make a connection to the remote Java server, otherwise,
> it does not work either.
> I will ask remote java server group to find out their config.
>
> Thanks so much,
> Linda
>
>
>
>
>
>
> --
> Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by cgh467 <xl...@yahoo.com.INVALID>.
On device localhost, I was using "qpidd --transport ssl --ssl-port 5673
--ssl-cert-db database --ssl-cert-password-file........." as broker. Then
run my qpid c++ ssl client. It worked. The device has limited memory, could
not install java. The remote is qpid java server.
By the way, I tried to run "qpid-stat -q -b" with remote URL on the device.
it reported ConnectionError too. Even with openssl, I have to give specific
"-tls1_2" option to make a connection to the remote Java server, otherwise,
it does not work either.
I will ask remote java server group to find out their config.
Thanks so much,
Linda
--
Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Gordon Sim <gs...@redhat.com>.
On 26/08/2020 4:52 pm, cgh467 wrote:
> Thanks for the reply. On localhost, I'm able to make a connection through my
> qpid c++ client. As long as I try to connect to remote server, it failed.
What is different between those two cases? Is the broker the same and
the same version in each case? Is the broker configured in the same way,
using the same version of java? Are you running either broker or client
on a different OS version in the two cases?
I would suggest trying to isolate the difference between what works and
what does not to see if that gives clues as to what you need to change.
You could also see if comparing wireshark traces from the case that
works with the case that doesn't sheds any light.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Robbie Gemmell <ro...@gmail.com>.
The client uses NSS for its TLS support as mentioned in the earlier
replies, and you are almost certainly using an old version given the
ancient OS, so it's not impossible updating (or somehow configuring)
NSS and its tools could influence things. It's not something I've ever
had to look at so I can't add much here.
It's probably obvious to state trying on a newer OS might be helpful
as well. Even if only doing so to see whether it works and verify the
rest of your setup.
Robbie
On Wed, 26 Aug 2020 at 16:52, cgh467 <xl...@yahoo.com.invalid> wrote:
>
> Thanks for the reply. On localhost, I'm able to make a connection through my
> qpid c++ client. As long as I try to connect to remote server, it failed.
> The full qpid trace is as below.
>
> 2020-08-26 11:28:52 [Messaging] debug Trying versions amqp0-10, amqp1.0
> 2020-08-26 11:28:52 [Client] debug Starting connection,
> urls=[amqp:ssl:test_lab4.engineering:5673]
> 2020-08-26 11:28:52 [Client] info Trying to connect to
> amqp:ssl:test_lab4.engineering:5673...
> 2020-08-26 11:28:52 [Client] debug Created IO thread: 0
> 2020-08-26 11:28:52 [Security] debug SslConnector created for 0-10
> 2020-08-26 11:28:52 [System] info Connecting: 10.44.221.115:5673
> 2020-08-26 11:28:53 [System] debug Exception constructed: Failed: Cannot
> communicate securely with peer: no common encryption algorithm(s). [-12286]
> (/development/fxgtla/qpid/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
> 2020-08-26 11:28:53 [Security] warning Connect failed: Failed: Cannot
> communicate securely with peer: no common encryption algorithm(s). [-12286]
> (/development/fxgtla/qpid/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
> 2020-08-26 11:28:53 [Client] debug Connection closed
> 2020-08-26 11:28:53 [System] debug Exception constructed: Connection closed
>
> Maybe some system lib or config need to be updated. I just don't know
> which ones. My device OS is ubuntu 12.04, the old system. That is why build
> the qpid 1.39 from the source
>
> Thanks
> Linda
>
>
>
>
> --
> Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by cgh467 <xl...@yahoo.com.INVALID>.
Thanks for the reply. On localhost, I'm able to make a connection through my
qpid c++ client. As long as I try to connect to remote server, it failed.
The full qpid trace is as below.
2020-08-26 11:28:52 [Messaging] debug Trying versions amqp0-10, amqp1.0
2020-08-26 11:28:52 [Client] debug Starting connection,
urls=[amqp:ssl:test_lab4.engineering:5673]
2020-08-26 11:28:52 [Client] info Trying to connect to
amqp:ssl:test_lab4.engineering:5673...
2020-08-26 11:28:52 [Client] debug Created IO thread: 0
2020-08-26 11:28:52 [Security] debug SslConnector created for 0-10
2020-08-26 11:28:52 [System] info Connecting: 10.44.221.115:5673
2020-08-26 11:28:53 [System] debug Exception constructed: Failed: Cannot
communicate securely with peer: no common encryption algorithm(s). [-12286]
(/development/fxgtla/qpid/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
2020-08-26 11:28:53 [Security] warning Connect failed: Failed: Cannot
communicate securely with peer: no common encryption algorithm(s). [-12286]
(/development/fxgtla/qpid/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
2020-08-26 11:28:53 [Client] debug Connection closed
2020-08-26 11:28:53 [System] debug Exception constructed: Connection closed
Maybe some system lib or config need to be updated. I just don't know
which ones. My device OS is ubuntu 12.04, the old system. That is why build
the qpid 1.39 from the source
Thanks
Linda
--
Sent from: http://qpid.2158936.n2.nabble.com/Apache-Qpid-users-f2158936.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Robbie Gemmell <ro...@gmail.com>.
On Fri, 21 Aug 2020 at 10:18, Gordon Sim <gs...@redhat.com> wrote:
>
> On 20/08/2020 11:32 pm, cgh467 wrote:
> > Hi,
> >
> > I ran into the same issue now. When I run qpid C++ client to connect
> > remote Java sever, I got below error:
> > 2020-08-20 18:25:33 [System] debug Exception constructed: Failed: Cannot
> > communicate securely with peer: no common encryption algorithm(s). [-12286]
> > (/development/fxgtla/qpid/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
> > 2020-08-20 18:25:33 [Security] warning Connect failed: Failed: Cannot
> > communicate securely with peer: no common encryption algorithm(s). [-12286]
> > (/development/fxgtla/qpid/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
> > 2020-08-20 18:25:33 [Client] debug Connection closed
> >
> > However, I was able to connect to remote server with openssl as below:
> > openssl s_client -connect lab4.engineering:5673 -tls1_2
> >
> > Is there any way to force cpp client to use TLSv1.2/TLSv1.1?
>
> The qpid::messaging client does not use openssl, it use nss. There is no
> support explicitly in the client to enable more detailed configuration
> of versions and algorithms. There may be some generic way to do it
> through options/configuration in the nss db, but I can't find anything
> on that.
>
> (However assuming you have a relatively recent nss library, I would be
> surprised if TLSv1.2 is not supported. The error sounds like it is the
> particular ciphers used that there is no match for.)
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
I ran the qpid-cpp 1.39.0 client against Broker-J 8.0.0, and it
connected using TLS 1.2.
(I passed -Djavax.net.debug=all via QPID_OPTS env variable to have
Java log the activity).
I configured the broker using a broker keystore file from the qpid-jms
test suite, and then created a certdb containing the CA cert used to
sign that key. The steps I used for the latter were:
mkdir certdir
certutil -N -d certdir
certutil -A -n cacert -t "CT,," -i ca.crt -d certdir
Creating the certdb asks for a password. The client requires that to
be provided in a file later, so I created one:
echo "yourpassword" > certdir_password_file
I used a URL for the client of "amqp:ssl:localhost:5671" to enable
SSL. I then passed the certdb config and ran the application with:
QPID_CERT_PASSWORD_FILE=/path.to/certdir_password_file
QPID_SSL_CERT_DB=/path.to/certdir ./your_application
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Problem with establishing TLS1.1/TLS1.2 connection between cpp
client and java broker with disabled TLS1.0 on broker side
Posted by Gordon Sim <gs...@redhat.com>.
On 20/08/2020 11:32 pm, cgh467 wrote:
> Hi,
>
> I ran into the same issue now. When I run qpid C++ client to connect
> remote Java sever, I got below error:
> 2020-08-20 18:25:33 [System] debug Exception constructed: Failed: Cannot
> communicate securely with peer: no common encryption algorithm(s). [-12286]
> (/development/fxgtla/qpid/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
> 2020-08-20 18:25:33 [Security] warning Connect failed: Failed: Cannot
> communicate securely with peer: no common encryption algorithm(s). [-12286]
> (/development/fxgtla/qpid/qpid-cpp-1.39.0/src/qpid/sys/ssl/SslSocket.cpp:205)
> 2020-08-20 18:25:33 [Client] debug Connection closed
>
> However, I was able to connect to remote server with openssl as below:
> openssl s_client -connect lab4.engineering:5673 -tls1_2
>
> Is there any way to force cpp client to use TLSv1.2/TLSv1.1?
The qpid::messaging client does not use openssl, it use nss. There is no
support explicitly in the client to enable more detailed configuration
of versions and algorithms. There may be some generic way to do it
through options/configuration in the nss db, but I can't find anything
on that.
(However assuming you have a relatively recent nss library, I would be
surprised if TLSv1.2 is not supported. The error sounds like it is the
particular ciphers used that there is no match for.)
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org