7.7. Securing Java Clients
To support SSL/TLS security in Java clients, Red Hat JBoss A-MQ provides the
org.apache.activemq.ActiveMQSslConnectionFactoryclass. Use the
ActiveMQSslConnectionFactoryclass in place of the insecure
ActiveMQConnectionFactoryclass in order to enable SSL/TLS security in your clients.
ActiveMQSslConnectionFactoryclass exposes the following methods for configuring SSL/TLS security:
- Specifies the location of the client's trust store file, in JKS format (as managed by the Java
- Specifies the password that unlocks the client trust store.
- (Optional) Specifies the location of the client's own X.509 certificate and private key in a key store file, in JKS format (as managed by the Java
keystoreutility). Clients normally do not need to provide their own certificate, unless the broker SSL/TLS configuration specifies that client authentication is required.
- (Optional) Specifies the password that unlocks the client key store. This password is also used to decrypt the private key from in the key store.
For more advanced applications,
ActiveMQSslConnectionFactoryalso exposes the
setKeyAndTrustManagersmethod, which lets you specify the
javax.net.ssl.KeyManagerarray and the
Specifying the trust store and key store locations
Location strings passed to the
setKeyStoremethods can have either of the following formats:
- A pathname—where no scheme is specified, for example,
/conf/client.ts. In this case the resource is loaded from the classpath, which is convenient to use when the client and its certificates are packaged in a JAR file.
- A Java URL—where you can use any of the standard Java URL schemes, such as
file. For example, to reference the file,
C:\ActiveMQ\conf\client.ts, in the filesystem on a Windows O/S, use the URL,
Sample client code
Example 7.1, “Java Client Using the ActiveMQSslConnectionFactory Class” shows an example of how to initialize a message producer client in Java, where the message producer connects to the broker using the SSL/TLS protocol. The key step here is that the client uses the
ActiveMQSslConnectionFactoryclass to create the connection, also setting the trust store and trust store password (no key store is required here, because we are assuming that the broker port does not require client authentication).
Example 7.1. Java Client Using the ActiveMQSslConnectionFactory Class
import javax.jms.Connection; import javax.jms.Destination; import javax.jms.MessageProducer; import javax.jms.Session; import org.apache.activemq.ActiveMQSslConnectionFactory; ... String url = "ssl://localhost:61617" // The broker URL // Configure the secure connection factory. ActiveMQSslConnectionFactory connectionFactory = new ActiveMQSslConnectionFactory(url); connectionFactory.setTrustStore("/conf/client.ts"); connectionFactory.setTrustStorePassword("password"); // Create the connection. Connection connection = connectionFactory.createConnection(); connection.start(); // Create the session Session session = connection.createSession(transacted, Session.AUTO_ACKNOWLEDGE); Destination destination = session.createQueue(subject); // Create the producer. MessageProducer producer = session.createProducer(destination);