客户端无法通过 SSL 连接到 Apache Artemis答案

【问题标题】：Client failed to connect to Apache Artemis via SSL客户端无法通过 SSL 连接到 Apache Artemis
【发布时间】：2020-06-19 15:33:20
【问题描述】：

我在服务器上配置了带有 SSL 的单个独立 Artemis。

我生成了 trustStore 和 keyStore

    openssl genrsa -des3 -out brokerRoot.key 4096
    openssl req -newkey rsa:2048 -nodes -keyout brokerRoot.key -x509 -days 3600 -out brokerRoot.pem -subj "/C=US/ST=Maryland/L=Aberdeen/O=Company/OU=IT/CN=company/emailAddress=test@test.de" -passin pass:passphrase
    openssl pkcs12 -inkey brokerRoot.key -in brokerRoot.pem -export -out broker_ks.p12 -password pass:keyStorePassword
    //Create a truststore for the client
    keytool -import -alias broker -keystore client_ts.p12 -file brokerRoot.pem -deststoretype pkcs12 -storepass trustStorePassword -noprompt

broker.xml

<?xml version='1.0'?>

<configuration xmlns="urn:activemq"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xmlns:xi="http://www.w3.org/2001/XInclude"
               xsi:schemaLocation="urn:activemq /schema/artemis-configuration.xsd">

   <core xmlns="urn:activemq:core" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="urn:activemq:core ">

      <name>0.0.0.0</name>


      <persistence-enabled>true</persistence-enabled>

      <journal-type>ASYNCIO</journal-type>

      <paging-directory>data/paging</paging-directory>

      <bindings-directory>data/bindings</bindings-directory>

      <journal-directory>data/journal</journal-directory>

      <large-messages-directory>data/large-messages</large-messages-directory>

      <journal-datasync>true</journal-datasync>

      <journal-min-files>2</journal-min-files>

      <journal-pool-files>10</journal-pool-files>

      <journal-device-block-size>4096</journal-device-block-size>

      <journal-file-size>10M</journal-file-size>

      <journal-buffer-timeout>28000</journal-buffer-timeout>


      <journal-max-io>4096</journal-max-io>

      <disk-scan-period>5000</disk-scan-period>

      <max-disk-usage>100</max-disk-usage>

      <critical-analyzer>true</critical-analyzer>

      <critical-analyzer-timeout>120000</critical-analyzer-timeout>

      <critical-analyzer-check-period>60000</critical-analyzer-check-period>

      <critical-analyzer-policy>HALT</critical-analyzer-policy>


      <page-sync-timeout>1628000</page-sync-timeout>

            <global-max-size>204Mb</global-max-size>
      <!-- Connectors -->
      <connectors>
         <connector name="netty-connector">tcp://hostname:61616?sslEnabled=true;trustStorePath=/home/artemis/client_ts.p12;trustStorePassword=trustStorePassword</connector>
      </connectors>

      <acceptors>
        <acceptor name="netty-acceptor">tcp://hostname:61616?sslEnabled=true;keyStorePath=/home/artemis/broker_ks.p12;keyStorePassword=keyStorePassword</acceptor>
      </acceptors>

      <cluster-connections>
         <cluster-connection name="my-cluster">
            <connector-ref>netty-connector</connector-ref>
            <retry-interval>1000</retry-interval>
            <retry-interval-multiplier>3</retry-interval-multiplier>
            <use-duplicate-detection>true</use-duplicate-detection>
            <message-load-balancing>STRICT</message-load-balancing>
         </cluster-connection>
      </cluster-connections>

      <security-settings>
         <security-setting match="#">
            <permission type="createNonDurableQueue" roles="amq"/>
            <permission type="deleteNonDurableQueue" roles="amq"/>
            <permission type="createDurableQueue" roles="amq"/>
            <permission type="deleteDurableQueue" roles="amq"/>
            <permission type="createAddress" roles="amq"/>
            <permission type="deleteAddress" roles="amq"/>
            <permission type="consume" roles="amq"/>
            <permission type="browse" roles="amq"/>
            <permission type="send" roles="amq"/>
            <!-- we need this otherwise ./artemis data imp wouldn't work -->
            <permission type="manage" roles="amq"/>
         </security-setting>
      </security-settings>

      <addresses>
         <address name="exampleQueue">
            <anycast>
               <queue name="exampleQueue"/>
            </anycast>
         </address>
         <address name="DLQ">
            <anycast>
               <queue name="DLQ" />
            </anycast>
         </address>
         <address name="ExpiryQueue">
            <anycast>
               <queue name="ExpiryQueue" />
            </anycast>
         </address>
      </addresses>

      <address-settings>
         <!-- if you define auto-create on certain queues, management has to be auto-create -->
         <address-setting match="activemq.management#">
            <dead-letter-address>DLQ</dead-letter-address>
            <expiry-address>ExpiryQueue</expiry-address>
            <redelivery-delay>0</redelivery-delay>
            <!-- with -1 only the global-max-size is in use for limiting -->
            <max-size-bytes>-1</max-size-bytes>
            <message-counter-history-day-limit>10</message-counter-history-day-limit>
            <address-full-policy>PAGE</address-full-policy>
            <auto-create-queues>true</auto-create-queues>
            <auto-create-addresses>true</auto-create-addresses>
            <auto-create-jms-queues>true</auto-create-jms-queues>
            <auto-create-jms-topics>true</auto-create-jms-topics>
         </address-setting>
         <!--default for catch all-->
         <address-setting match="#">
            <dead-letter-address>DLQ</dead-letter-address>
            <expiry-address>ExpiryQueue</expiry-address>
            <redelivery-delay>0</redelivery-delay>
            <!-- with -1 only the global-max-size is in use for limiting -->
            <max-size-bytes>-1</max-size-bytes>
            <message-counter-history-day-limit>10</message-counter-history-day-limit>
            <address-full-policy>PAGE</address-full-policy>
            <auto-create-queues>true</auto-create-queues>
            <auto-create-addresses>true</auto-create-addresses>
            <auto-create-jms-queues>true</auto-create-jms-queues>
            <auto-create-jms-topics>true</auto-create-jms-topics>
         </address-setting>
         <address-setting match="exampleQueue">            
            <dead-letter-address>DLQ</dead-letter-address>                      
            <redelivery-delay>1000</redelivery-delay>    
            <max-delivery-attempts>3</max-delivery-attempts>
            <max-size-bytes>-1</max-size-bytes>
            <page-size-bytes>1048576</page-size-bytes>
            <message-counter-history-day-limit>10</message-counter-history-day-limit>
            <address-full-policy>PAGE</address-full-policy>
        </address-setting>
      </address-settings>
   </core>
</configuration>

bootstrap.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<broker xmlns="http://activemq.org/schema">
   <jaas-security domain="activemq"/>
   <server configuration="file:/home/artemis-broker/etc//broker.xml"/>

   <web bind="https://0.0.0.0:8161" path="web" keyStorePath="/home/artemis_certs/broker_ks.p12" keyStorePassword="keyStorePassword" trustStorePath="/home/artemis_certs/client_ts.p12" trustStorePassword="trustStorePassword">
       <app url="activemq-branding" war="activemq-branding.war"/>
       <app url="artemis-plugin" war="artemis-plugin.war"/>
       <app url="console" war="console.war"/>
   </web>
</broker>

我的 Java 客户端试图与 Artemis 建立连接，但出现错误 密钥库格式无效 jms 配置是这样的

jms.artemis.broker.url=tcp://hostname:61616?sslEnabled=true&trustStorePath=./certs/client_ts.p12&trustStorePassword=trustStorePassword
jms.artemis.user=admin
jms.artemis.password=admin

有人可以帮我解决这个问题吗？是不是我配置错了？

【问题讨论】：

此配置 LGTM 可能相对信任存储路径无效我会使用绝对路径，即：trustStorePath=/home/artemis/client_ts.p12 in jms.artemis.broker.url。
但它说Invalid keystore format ？我认为如果路径错误，它会说"Can't find keystore" 或其他东西。我已经对其进行了测试，我故意将路径更改为错误的路径，这是另一条错误路径的错误消息
我使用OpenSSLExamplegithub.com/apache/activemq-artemis/tree/2.13.0/examples/… 成功检查了您在 ActiveMQ Artemis 2.13 上的配置。你用的是什么版本？
我使用的是 Artemis 2.11。我将尝试将其更新到 2.13。顺便说一句，我的jms.artemis.broker.url=tcp://hostname:61616?ha=true&sslEnabled=true&trustStorePath=/home/artemis/client_ts.p12&trustStorePassword=trustStorePassword 看起来不错吗？
你应该用%3A和%5C替换字符:和\，因为它们是url查询的非法字符，即tcp://hostname:61616?ha=true&sslEnabled=true&trustStorePath=C%3A%5CUsers%5Cmy_username%5Ccerts%5Cclient_ts.p12&trustStorePassword=trustStorePassword

标签： ssl activemq-artemis

【解决方案1】：

我们有一个使用 artemis 运行的 docker 容器。我们使用 Java 版本的 OpenJDK 11.0.12 (A) 生成了密钥库。在我们的 docker 容器中，我们有 1.8.0._302 (B) 版本。

版本 A 生成的密钥库与版本 B 不匹配。发现后，我们在 Dock-Container 中生成了版本 B 的密钥库，一切正常。

这个答案帮助了我们：https://stackoverflow.com/a/65784061/4578611

【讨论】：