ActiveMQ and the SSL Transport

In a previous article I’ve shown how to configure ActiveMQ for High Availability in a “shared storage master/slave” scenario. Now let’s see how you can communicate with ActiveMQ using the SSL transport. ActiveMQ uses the Java Secure Socket Extension (JSSE) to implement its SSL functionality so you must include SSL certificates for successful SSL communication. In this article, I will show an example of an SSL trusted client/server connection using either the Java SSL System Properties (directly in a Maven profile) or the Spring beans definition. Here the roadmap.

ROADMAP

1. Creating your own SSL certificates (keystore and truststore files)
2. Enabling the SSL transport for ActiveMQ with trusted clients
3. Setup clients using Java SSL System Properties in a Maven profile
4. Setup clients using Spring

1.  Creating your own SSL certificates (keystore and trustedstore files)

I have summed up the process of creating and sharing self-signed certificates using the command-line “keytool” distributed with Java.

## Create a keystore for the broker SERVER
$ keytool -genkey -alias amq-server -keyalg RSA -keysize 2048 -validity 90 -keystore amq-server.ks

## Export the broker SERVER certificate from the keystore
$ keytool -export -alias amq-server -keystore amq-server.ks -file amq-server_cert

## Create the CLIENT keystore
$ keytool -genkey -alias amq-client -keyalg RSA -keysize 2048 -validity 90 -keystore amq-client.ks

## Import the previous exported broker's certificate into a CLIENT truststore
$ keytool -import -alias amq-server -keystore amq-client.ts -file amq-server_cert

## If you want to make trusted also the client, you must export the client's certificate from the keystore
$ keytool -export -alias amq-client -keystore amq-client.ks -file amq-client_cert

## Import the client's exported certificate into a broker SERVER truststore
$ keytool -import -alias amq-client -keystore amq-server.ts -file amq-client_cert

## Other useful commands
$ openssl s_client -connect activemq-host:61617
$ keytool -list -keystore amq-server.ks
$ keytool -printcert -v -file amq-server_cert
$ keytool -storepasswd -keystore amq-server.ks

2. Enabling the SSL transport for ActiveMQ with trusted clients

To configure the ActiveMQ broker to use the SSL transport, the first thing to do is to replace the default keystore and truststore files in the conf directory with the ones that were previously created.

$ cp amq-server.ks ${ACTIVEMQ_HOME}/conf/
$ cp amq-server.ts ${ACTIVEMQ_HOME}/conf/

Now change the <transportConnectors> element in the ${ACTIVEMQ_HOME}/conf/activemq.xml file and specify the “needClientAuth=true” parameter which instructs the broker to check connecting client certificates and allow access only to those that are found in the truststore. Edit the file  ${ACTIVEMQ_HOME}/conf/activemq.xml as below.

<broker xmlns="http://activemq.apache.org/schema/core" brokerName="fnmamq01" dataDirectory="/mnt/amq_data/amq-5.9">
 <!-- blablablabla -->

 <transportConnectors>
     <transportConnector name="ssl" uri="ssl://0.0.0.0:61617?trace=true&needClientAuth=true" />
 </transportConnectors>

  <!-- SSL Configuration Context -->
  <sslContext>
     <sslContext keyStore="file:${activemq.base}/conf/amq-server.ks"
                 keyStorePassword="123456"
                 trustStore="file:${activemq.base}/conf/amq-server.ts"
                 trustStorePassword="123456" />
  </sslContext>

</broker>

If no error occurs, you can see the following message at the ActiveMQ bootstrap.

 3. Setup clients using Java SSL System Properties in a Maven profile

The typical URI syntax for the SSL protocol is ssl://hostname:port?key=value. If you have configured a Master/Slave ActiveMQ instance for High Availability you must use a failover connection string like this failover:(ssl://amq01:61617,ssl://amq02:61617)?randomize=false. In my example I have used a ResouceBundle to externalize some properties like the broker connection string.

– activemq-samples/ssl-transport/src/main/resources/configuration.properties

### TCP over SSL Access to a Master/Slave  ActiveMQ istance
amq.url=failover:(ssl://amq01:61617,ssl://amq02:61617)?randomize=false

– activemq-samples/ssl-transport/src/main/java/activemq/samples/ssltransport/Producer.java

public class Producer {

    ResourceBundle settings = ResourceBundle.getBundle("configuration");
    private String brokerURL = settings.getString("amq.url");

    private static transient ConnectionFactory factory;
    private transient Connection connection;
    private transient Session session;
    private transient MessageProducer producer;

    private static int count = 10;
    private static int total;
    private static int id = 1000000;

    private String jobs[] = new String[]{"coda1", "coda2"};

    public Producer() throws JMSException {
    	factory = new ActiveMQConnectionFactory(brokerURL);
    	connection = factory.createConnection();
        connection.start();
        session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
        producer = session.createProducer(null);
    }    
// Something other here ...
}

When using JSSE, in order to successfully connect to the broker via SSL, you must provide  the keystore, the keystore password, and the truststore as system properties. You can set the JAVA_OPTS enviorment variable using the following java system properties.

JAVA_OPTS="-Djavax.net.ssl.keyStore=${ACTIVEMQ_HOME}/conf/amq-client.ks
-Djavax.net.ssl.keyStorePassword=123456
-Djavax.net.ssl.trustStore=${ACTIVEMQ_HOME}/conf/amq-client.ts
-Djavax.net.ssl.trustStorePassword=123456"

To run clients with the Java SSL System Properties, I have used in this example the “exec-maven-plugin” in a dedicated Maven profile. Here is an example for the Producer.

– activemq-samples/ssl-transport/pom.xml

<properties>
		<sslsample.keystore>${basedir}/src/main/resources/amq-client.ks</sslsample.keystore>
		<sslsample.keypasswd>123456</sslsample.keypasswd>
		<sslsample.truststore>${basedir}/src/main/resources/amq-client.ts</sslsample.truststore>
		<sslsample.truststorepasswd>123456</sslsample.truststorepasswd>
	</properties>

	<profiles>
		<profile>
			<id>producer</id>
			<build>
				<plugins>
					<plugin>
						<groupId>org.codehaus.mojo</groupId>
						<artifactId>exec-maven-plugin</artifactId>
						<version>1.2.1</version>
						<executions>
							<execution>
								<goals>
									<goal>java</goal>
								</goals>
							</execution>
						</executions>
						<configuration>
							<mainClass>activemq.samples.ssltransport.Producer</mainClass>
							<systemProperties>
								<systemProperty>
									<key>javax.net.ssl.keyStore</key>
									<value>${sslsample.keystore}</value>
								</systemProperty>
								<systemProperty>
									<key>javax.net.ssl.keyStorePassword</key>
									<value>${sslsample.keypasswd}</value>
								</systemProperty>
								<systemProperty>
									<key>javax.net.ssl.trustStore</key>
									<value>${sslsample.truststore}</value>
								</systemProperty>
								<systemProperty>
									<key>javax.net.ssl.trustStorePassword</key>
									<value>${sslsample.truststorepasswd}</value>
								</systemProperty>
							</systemProperties>
						</configuration>
					</plugin>
				</plugins>
			</build>
		</profile>			
	</profiles>

Compile the project source and run the maven “exec:java” goal

$ cd activemq-samples/ssl-transport
$ mvn clean install
$ mvn exec:java -Pproducer

If no errors occur, you can see the SSL connection established message in the output console

 4. Setup clients using Spring

If you want to use Spring for your clients, you can define your own JMS SSL Connection Factory using the org.apache.activemq.ActiveMQSslConnectionFactory object.

–  activemq-samples/ssl-transport/src/main/resources/SpringBeans-Producer.xml 

<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
	http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">

	<bean id="propertyPlaceholderConfigurer"
		class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
		<property name="locations">
			<list>
				<value>classpath:configuration.properties</value>
			</list>
		</property>
	</bean>

	<!-- SSL Connection Factory -->
	<bean id="jmsSslConnectionFactory" class="org.apache.activemq.ActiveMQSslConnectionFactory">
		<property name="brokerURL" value="${amq.url}" />
		<property name="keyStore" value="amq-client.ks" />
		<property name="keyStorePassword" value="123456" />
		<property name="trustStore" value="amq-client.ts" />
		<property name="trustStorePassword" value="123456" />
    	</bean>

	<bean id="jmsTemplate" class="org.springframework.jms.core.JmsTemplate">
		<property name="connectionFactory" ref="jmsSslConnectionFactory" />
	</bean>

	<bean id="producer" class="activemq.samples.ssltransport.Producer" scope="prototype">
		<property name="template" ref="jmsTemplate" />
	</bean>

</beans>