Appendix A. Managing certificates

A.1. Installing certificate authority certificates

SSL/TLS authentication relies on digital certificates issued by trusted Certificate Authorities (CAs). When an SSL/TLS connection is established by a client, the AMQP peer sends a server certificate to the client. This server certificate must be signed by one of the CAs in the client’s Trusted Root Certification Authorities certificate store.

If the user is creating self-signed certificates for use by Red Hat AMQ Broker, then the user must create a CA to sign the certificates. Then the user can enable the client SSL/TLS handshake by installing the self-signed CA file ca.crt.

  1. From an administrator command prompt, run the MMC Certificate Manager plugin, certmgr.msc.
  2. Expand the Trusted Root Certification Authorities folder on the left to expose Certificates.
  3. Right-click Certificates and select All Tasks and then Import.
  4. Click Next.
  5. Browse to select file ca.crt.
  6. Click Next.
  7. Select Place all certificates in the following store.
  8. Select certificate store Trusted Root Certification Authorities.
  9. Click Next.
  10. Click Finish.

For more information about installing certificates, see Managing Microsoft Certificate Services and SSL.

A.2. Installing client certificates

In order to use SSL/TLS and client certficates, the certificates with the client’s private keys must be imported into the proper certificate store on the client system.

  1. From an administrator command prompt, run the MMC Certificate Manager plugin, certmgr.msc.
  2. Expand the Personal folder on the left to expose Certificates.
  3. Right-click Certificates and select All Tasks and then Import.
  4. Click Next.
  5. Click Browse.
  6. In the file type pulldown, select Personal Information Exchange (\.pfx;*.p12).
  7. Select file client.p12 and click Open.
  8. Click Next.
  9. Enter the password for the private key password field. Accept the default import options.
  10. Click Next.
  11. Select Place all certificates in the following store.
  12. Select certificate store Personal.
  13. Click Next.
  14. Click Finish.

A.3. Hello World using client certificates

Before a client will return a certificate to the broker, the AMQ .NET library must be told which certificates to use. The client certificate file client.crt is added to the list of certificates to be used during SChannel connection startup. 

factory.SSL.ClientCertificates.Add(
    X509Certificate.CreateFromCertFile(certfile)
    );

In this example, certfile is the full path to the client.p12 certificate installed in the Personal certificate store. A complete example is found in HelloWorld-client-certs.cs. This source file and the supporting project files are available in the SDK.