Red Hat Training

A Red Hat training course is available for Red Hat AMQ

Chapter 3. Configuring SSL for AMQ Broker on OpenShift Container Platform

3.1. Configuring SSL

For a minimal SSL configuration to allow connections outside of OpenShift Container Platform, AMQ Broker requires a broker keystore, a client keystore, and a client truststore that includes the broker keystore. The broker keystore is also used to create a secret for the AMQ Broker on OpenShift Container Platform image, which is added to the service account.

The following example commands use Java KeyTool, a package included with the Java Development Kit, to generate the necessary certificates and stores.

Procedure

  1. Generate a self-signed certificate for the broker keystore: 

    $ keytool -genkey -alias broker -keyalg RSA -keystore broker.ks

  2. Export the certificate so that it can be shared with clients: 

    $ keytool -export -alias broker -keystore broker.ks -file broker_cert

  3. Generate a self-signed certificate for the client keystore: 

    $ keytool -genkey -alias client -keyalg RSA -keystore client.ks

  4. Create a client truststore that imports the broker certificate: 

    $ keytool -import -alias broker -keystore client.ts -file broker_cert

  5. Export the client’s certificate from the keystore: 

    $ keytool -export -alias client -keystore client.ks -file client_cert

  6. Import the client’s exported certificate into a broker SERVER truststore: 

    $ keytool -import -alias client -keystore broker.ts -file client_cert

3.2. Generating the AMQ Broker secret

The broker keystore can be used to generate a secret for the namespace, which is also added to the service account so that the applications can be authorized.

Procedure

  • At the command line, run the following commands: 

    $ oc create secret generic <secret-name> --from-file=<broker-keystore> --from-file=<broker-truststore>
$ oc secrets add sa/<service-account-name> secret/<secret-name>

3.3. Creating an SSL route

After the AMQ Broker on OpenShift Container Platform image has been deployed, an SSL route needs to be created for the AMQ Broker transport protocol port to allow connections to AMQ Broker outside of OpenShift.

In addition, selecting Passthrough for TLS Termination relays all communication to AMQ Broker without the OpenShift router decrypting and resending it. Only SSL routes can be exposed because the OpenShift router requires SNI to send traffic to the correct service.

The default ports for the various AMQ Broker transport protocols are:

Table 3.1. Default ports for AMQ Broker transport protocols

AMQ Broker transport protocolDefault port

All protocols

61616

All protocols (SSL)

61617

AMQP

5672

AMQP (SSL)

5671

MQTT

1883

MQTT (SSL)

8883

STOMP

61613

STOMP (SSL)

61612

Additional resources