时间戳

首页 > 解决方案 > 通过 SSL ActiveMQ 连接 2 个代理

ssl - 通过 SSL ActiveMQ 连接 2 个代理

问题描述

我正在尝试创建一个由 2 个本地代理组成的 ActiveMQ 网络。我已经完成了如下配置。我对此很陌生，不确定我错过了什么。我向两个经纪人提供了相同的 ks 和 ts。

    <networkConnectors>
              <networkConnector name="LinktoInstance1"
                                uri="static:(ssl://localhost:61616)"
                                duplex="false"
                                networkTTL="2"
                                dynamicOnly="true"/>
    </networkConnectors>

     <transportConnectors>
                <transportConnector name="ssl" uri="ssl://0.0.0.0:61617?trace=true&amp;needClientAuth=true"/>
     </transportConnectors>

    <sslContext>
             <sslContext keyStore="file:${activemq.home}/SSL/broker.ks" keyStorePassword="##" trustStore="file:${activemq.home}/SSL/broker.ts" trustStorePassword="##"/>
     </sslContext>

启动时，我在两个经纪人上都收到以下错误。

 WARN | Could not start network bridge between: vm://instance1 and: ssl://localhost:61617 due to: Connection refused: connect
 INFO | Network Connector DiscoveryNetworkConnector:LinktoInstance2:BrokerService[instance1] started
 INFO | Apache ActiveMQ 5.16.2 (instance1, ID:XXXXX-8986975-0:1) started
 INFO | For help or more information please see: http://activemq.apache.org
 INFO | Establishing network connection from vm://instance1 to ssl://localhost:61617
 INFO | Connector vm://instance1 started
 INFO | Error with pending remote brokerInfo on: ssl://localhost/127.0.0.1:61617 (Connection has been shutdown: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed)
 INFO | instance1 Shutting down LinktoInstance2
 WARN | Could not accept connection from tcp://127.0.0.1:60937: Received fatal alert: certificate_unknown (Received fatal alert: certificate_unknown)
 INFO | instance1 bridge to Unknown stopped
 INFO | Error with pending local brokerInfo on: vm://instance1#2 (peer (vm://instance1#3) stopped.)

标签： sslactivemqbroker

解决方案

PKIX 路径错误通常意味着某种证书链失败。它可能是 CA 或中间证书，可能无法从远程端发送，或者在信任库中正确发送、证书过期、主机名不匹配等。发布完整的堆栈跟踪 - 应该有一个“Caused by:”，并提供更多详细信息.

提示：设置 -Djava.net.debug=ssl 对调试证书问题非常有帮助。

也有很多变化：

-Djavax.net.debug=ssl,handshake

-Djavax.net.debug=ssl:handshake:verbose:keymanager:trustmanager -Djava.security.debug=access:stack

OpenSSL 命令行在验证远程服务器是否发送良好的证书链方面也非常有用：openssl to validate remote server

推荐阅读