Page Comparison

WSO2 Message Broker provides support to send/receive messages via secured connections using the SSL/TLS protocol. The following instructions describe how to configure the MB server and JMS clients to communicate via encrypted connections using SSL.

Info

With the current Carbon implementation, tenant-wise keystores are not supported for SSL connection creations and even for a child tenant, you have to use super tenant keystores. Tenant keystores are written to the registry and used in WS security etc.

Only the default Carbon keystore can be used to create an SSL connection between the MB server and clients. In addition, keystores uploaded using the Admin console UI (Home > Configure > Keystores) cannot be used to make SSL connections between the server and client.

To change the default Carbon keystore,

1. Replace the wso2carbon.jks file with a new keystore.
2. Change the configuration details in the carbon.xml and broker.xml files accordingly.

Enabling SSL in the broker

To enable SSL in the server side, change the following entries in the <MB_HOME>/repository/conf/broker.xml file under the relevant transport:

Code Block

language	html/xml

<sslConnection enabled="true" port="8672">
    <keyStore>
         <location>repository/resources/security/wso2carbon.jks</location>
         <password>wso2carbon</password>

The parameters in the above configuration are as follows.

Parameter Description

SSL Connection

This contains the basic configurations relating to the SSL connection. Setting the

enabled="true" attribute ensures that SSL is enabled by default when the MB server is started. The

port="8672" attribute sets 8672 as the default SSL listener port for messages/command sent via the relevant transport.

Location The path of the keystore directory.

Password The password to the keystore directory.

Configuring JMS Clients to use SSL

SSL parameters are configured and sent to the broker as broker options in the TCPConnectionURL defined by the client. You need to set the 'ssl=true' property in the url and specify the keystore and client trust store paths and passwords. Use the connection url format shown below to pass the SSL parameters:

Code Block

String connectionURL = "amqp://<USERNAME>:<PASSWORD>@carbon/carbon?brokerlist='tcp://<IP>:<SSL_POR T>?ssl='true'&ssl_cert_alias='<CERTIFICATE_ALIAS_IN_TRUSTSTORE>'&trust_store=' <PATH_TO_TRUST_STORE>'&trust_store_password='<TRUSTSTORE_PASSWORD>'& key_store='<PATH_TO_KEY_STORE>'&key_store_password='<KEYSTORE_PASSWOR D>''";

Setting the 'ssl_cert_alias' property is not mandatory and can be used as an optional way to specify which certificate the broker should use if the truststore contains multiple entries. Shown below is an example connection url using default keystores and trust stores in WSO2 carbon products:

...

Versions Compared

Old Version 5

New Version 6

Key

Enabling SSL in the broker

Configuring JMS Clients to use SSL