Connecting HornetQ using SSl connection JBoss EAP 6.1 messaging subsystem

[ravi21588]

Iam trying to connect to HornetQ server using SSL in JBoss EAP 6.1. I have added the connector,acceptor,SSL Connection factory in hornetQ server configuration.

Configuration in HornetQ server messaging subsytem is as below:

Connector configuration:

    <connectors>

                        <netty-connector name="netty" socket-binding="messaging"/>

                        <netty-connector name="netty-throughput" socket-binding="messaging-throughput">

                            <param key="batch-delay" value="50"/>

                        </netty-connector>

                        <netty-connector name="netty-ssl" socket-binding="ssl-messaging">

                            <param key="ssl-enabled" value="true"/>

                            <param key="trust-store-path" value="/opt/jboss/security/CompanyServerTruststore.jks"/>

                            <param key="trust-store-password" value="changeit"/>

                        </netty-connector>

                        <in-vm-connector name="in-vm" server-id="0"/>

     </connectors>

Acceptor Configuration:

    <acceptors>

                                <netty-acceptor name="netty" socket-binding="messaging"/>

                                <netty-acceptor name="netty-throughput" socket-binding="messaging-throughput">

                                    <param key="batch-delay" value="50"/>

                                    <param key="direct-deliver" value="false"/>

                                </netty-acceptor>

                                <netty-acceptor name="netty-ssl" socket-binding="ssl-messaging">

                                    <param key="ssl-enabled" value="true"/>

                                    <param key="key-store-path" value="${jboss.web.ssl.keystore:/opt/jboss/security/CompanyServerKeyFile.jks}"/>

                                    <param key="key-store-password" value="${VAULT::CompanyKeystore::pw::1}"/>

                                </netty-acceptor>

                                <in-vm-acceptor name="in-vm" server-id="0"/>

      </acceptors>

Connectionfactory configuration:

    <connection-factory name="SSLRemoteConnectionFactory">

                            <connectors>

                                <connector-ref connector-name="netty-ssl"/>

                            </connectors>

                            <entries>

                                <entry name="java:jboss/exported/jms/SSLRemoteConnectionFactory"/>

                            </entries>

      </connection-factory>

Iam connecting to the server using hermes jms with remoting port and context factory org.jboss.naming.remote.client.InitialContextFactory and using the SSLRemoteConnectionFactory .

Error:

    HornetQException[errorType=NOT_CONNECTED message=HQ119007: Cannot connect to server(s). Tried with all available servers.]

    at org.hornetq.core.client.impl.ServerLocatorImpl.createSessionFactory(ServerLocatorImpl.java:863)

    at org.hornetq.jms.client.HornetQConnectionFactory.createConnectionInternal(HornetQConnectionFactory.java:583)

    at org.hornetq.jms.client.HornetQConnectionFactory.createConnection(HornetQConnectionFactory.java:107)

    at hermes.JNDIConnectionFactory.createConnection(JNDIConnectionFactory.java:113)

    at hermes.impl.jms.ConnectionManagerSupport.createConnection(ConnectionManagerSupport.java:126)

    at hermes.impl.jms.ConnectionManagerSupport.createConnection(ConnectionManagerSupport.java:92)

    at hermes.impl.jms.ConnectionSharedManager.reconnect(ConnectionSharedManager.java:81)

    at hermes.impl.jms.ConnectionSharedManager.connect(ConnectionSharedManager.java:91)

    at hermes.impl.jms.ConnectionSharedManager.getConnection(ConnectionSharedManager.java:104)

    at hermes.impl.jms.ConnectionSharedManager.getObject(ConnectionSharedManager.java:142)

    at hermes.impl.jms.ThreadLocalSessionManager.connect(ThreadLocalSessionManager.java:190)

    at hermes.impl.jms.ThreadLocalSessionManager.getSession(ThreadLocalSessionManager.java:570)

    at hermes.impl.jms.AbstractSessionManager.getDestination(AbstractSessionManager.java:387)

    at hermes.impl.DefaultHermesImpl.getDestination(DefaultHermesImpl.java:323)

    at hermes.browser.tasks.BrowseDestinationTask.invoke(BrowseDestinationTask.java:122)

    at hermes.browser.tasks.TaskSupport.run(TaskSupport.java:175)

    at hermes.browser.tasks.ThreadPool.run(ThreadPool.java:170)

    at java.lang.Thread.run(Thread.java:745)

is there anything wrong with my configuration.Do i need to create connectors,Acceptors and connection factory in HornetQ server.?

[jbertram]

Based on the stack-trace it looks to me like the problem is with network connectivity.  What's the socket-binding configuration?  Can you connect with the non-SSL connection factory?

[ravi21588]

Hi,

Please find the socket binding configurations below.

    <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">

        <socket-binding name="management-native" interface="management" port="${jboss.management.native.port:25040}"/>

        <socket-binding name="management-http" interface="management" port="${jboss.management.http.port:25041}"/>

        <socket-binding name="management-https" interface="management" port="${jboss.management.https.port:25042}"/>

        <socket-binding name="ajp" port="25000"/>

        <socket-binding name="http" port="25001"/>

        <socket-binding name="https" port="25002"/>

        <socket-binding name="jacorb" interface="unsecure" port="25003"/>

        <socket-binding name="jacorb-ssl" interface="unsecure" port="25004"/>

        <socket-binding name="messaging" port="25011"/>

        <socket-binding name="messaging-group" port="0" multicast-address="${jboss.messaging.group.address:231.7.7.7}" multicast-port="${jboss.messaging.group.port:25012}"/>

        <socket-binding name="messaging-throughput" port="25013"/>

        <socket-binding name="remoting" port="25015"/>

        <socket-binding name="txn-recovery-environment" port="25016"/>

        <socket-binding name="txn-status-manager" port="25017"/>

        <socket-binding name="ssl-messaging" port="25014"/>

        <outbound-socket-binding name="mail-smtp">

            <remote-destination host="${env.MAIL_PORT_25_TCP_ADDR:localhost}" port="${env.MAIL_PORT_25_TCP_PORT:25}"/>

        </outbound-socket-binding>

    </socket-binding-group>

Yes iam able to connect to non ssl connection factory.

[jbertram]

Can you confirm that port 25014 is accessible across the network from your client?  You might try changing the "ssl-messaging" socket-binding's "port" to 25011 since that one appears to be accessible.

Also, what JNDI properties are you using on Hermes? Please be explicit.

[ravi21588]

Hello justin,

I was able to telnet ipaddr port from windows machine and i was able to connect successfully,hence i was hoping there shouldn't be any firewall issue.

Attached Hermes JNDI properties screenshot for reference.

[jbertram]

Your configuration looks fine and the network seems OK so I'm not sure what the issue could be. Can you provide me with a reproducible test-case?

[ravi21588]

Dear Justin,

Iam checking if there is any issue with the certificates ie., is the keystore is imported in trustore correctly.I will get back to you shortly on this.

I have another Query is remote lookup via jndi is the only way to connect to hornet Q from external server.

[jbertram]

If you're using standard API (e.g. JMS, JNDI, etc.) then JNDI is the only way to connect to HornetQ (just like it is for all other JMS providers).  However, you can use the HornetQ API and simply instantiate the objects you need to connect.  I believe the HornetQ documentation covers this.

[ravi21588]

Hi Justin,

I came to know that the keystore certificates installed in the server are trusted certificatthe and the intermediate certificate in the chain are present in the trust store.Does the configurtion remains the same if it is trusted or selfsigned keystore certificate in the server?.And having intermidiate certificate alone in the trusted store is it sufficient for establishing the connection?

[jbertram]

I don't quite understand the details of what your saying, but it seems to me you're asking a more general question about SSL and what's necessary for a valid connection. I'm not an SSL expert so I recommend you consult Google for the information you're looking for.