2个代理之间通过SSL ActiveMQ的连接

Question

我正在尝试创建一个由2个本地代理组成的ActiveMQ网络。我已经完成了如下配置。我是个新手，不知道自己错过了什么。我已经向两个经纪人提供了相同的ks和ts。

<networkConnectors>
<networkConnector name="LinktoInstance1"
uri="static:(ssl://localhost:61616)"
duplex="false"
networkTTL="2"
dynamicOnly="true"/>
</networkConnectors>
<transportConnectors>
<transportConnector name="ssl" uri="ssl://0.0.0.0:61617?trace=true&amp;needClientAuth=true"/>
</transportConnectors>
<sslContext>
<sslContext keyStore="file:${activemq.home}/SSL/broker.ks" keyStorePassword="##" trustStore="file:${activemq.home}/SSL/broker.ts" trustStorePassword="##"/>
</sslContext>

在启动时，我在两个代理上都收到了以下错误。

WARN | Could not start network bridge between: vm://instance1 and: ssl://localhost:61617 due to: Connection refused: connect
INFO | Network Connector DiscoveryNetworkConnector:LinktoInstance2:BrokerService[instance1] started
INFO | Apache ActiveMQ 5.16.2 (instance1, ID:XXXXX-8986975-0:1) started
INFO | For help or more information please see: http://activemq.apache.org
INFO | Establishing network connection from vm://instance1 to ssl://localhost:61617
INFO | Connector vm://instance1 started
INFO | Error with pending remote brokerInfo on: ssl://localhost/127.0.0.1:61617 (Connection has been shutdown: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed)
INFO | instance1 Shutting down LinktoInstance2
WARN | Could not accept connection from tcp://127.0.0.1:60937: Received fatal alert: certificate_unknown (Received fatal alert: certificate_unknown)
INFO | instance1 bridge to Unknown stopped
INFO | Error with pending local brokerInfo on: vm://instance1#2 (peer (vm://instance1#3) stopped.)

Answer 1

PKIX路径错误通常意味着某种证书链失败。它可以是CA或中间证书，可能没有从远程端发送，或者在信任存储中正确发送，证书过期，主机名不匹配，等等；由以下原因引起：；详细信息。

提示：设置Djava.net.debug＝ssl对调试证书问题非常有用。

也有很多变化：

-Djavax.net.debug=ssl,handshake
-Djavax.net.debug=ssl:handshake:verbose:keymanager:trustmanager -Djava.security.debug=access:stack

OpenSSL命令行在验证远程服务器是否发送了良好的证书链方面也非常有用：OpenSSL用于验证远程服务器

Answer 2

我的应用程序也因Received fatal alert: certificate_unknown而失败

在我的案例中，StackOverflow文章ActiveMQ TLS主机主机名验证解决了我的问题。我不得不将socket.verifyHostName=false添加到客户端的连接字符串中，以便能够连接到localhost/127.0.0.1。

注意：在ActiveMQ 5.15.6中，他们启用了TLS主机名验证。看见https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=35862#SSLTransportReference-详细信息的主机名验证(从5.15.6版本开始(。