WSO2 Message Broker provides support to send/receive messages via secured connections using the SSL/TLS protocol. The following instructions describe how to configure the MB server and JMS clients to communicate via encrypted connections using SSL.
With the current Carbon implementation, tenant-wise keystores are not supported for SSL connection creations and even for a child tenant, you have to use super tenant keystores. Tenant keystores are written to the registry and used in messaging security etc.
To change the default Carbon keystore,
1. Replace thewso2carbon.jks file with a new keystore.2. Change the configuration details in the
carbon.xml and broker.xml files accordingly.| Table of Contents | ||||
|---|---|---|---|---|
|
Enabling SSL in the broker
To enable SSL in the server side, change the following entries in the the <MB_HOME>/repository/conf/broker.xml file file under the relevant transport:
| Code Block | ||
|---|---|---|
| ||
<sslConnection enabled="true" port="8672">
<keyStore>
<location>repository/resources/security/wso2carbon.jks</location>
<password>wso2carbon</password> |
The parameters in the above configuration are as follows.
| Parameter | Description | ||
|---|---|---|---|
| SSL Connection | This contains the basic configurations relating to the SSL connection. Setting the
| ||
| Location | The path of the keystore directorylocation where the keystore used for securing SSL connections is stored. By default this is the default keystore (
| ||
| Password | The password to of the keystore directory. |
Configuring JMS Clients to use SSL
SSL parameters are configured and sent to the broker as broker options in the the TCPConnectionURL defined defined by the client. You need to set the 'ssl=true' property in the url and specify the keystore and client trust store paths and passwords. Use the connection url format shown below to pass the SSL parameters:
| Code Block |
|---|
String connectionURL = "amqp://<USERNAME>:<PASSWORD>@carbon/carbon?brokerlist='tcp://<IP>:<SSL_POR T>?ssl='true'&ssl_cert_alias='<CERTIFICATE_ALIAS_IN_TRUSTSTORE>'&trust_store=' <PATH_TO_TRUST_STORE>'&trust_store_password='<TRUSTSTORE_PASSWORD>'& key_store='<PATH_TO_KEY_STORE>'&key_store_password='<KEYSTORE_PASSWOR D>''"; |
Setting the 'ssl_cert_alias' property is not mandatory and can be used as an optional way to specify which certificate the broker should use if the truststore trust store contains multiple entries.
Example: Consider that you have WSO2 Enterprise Service Bus (WSO2 ESB) as the JMS client. Shown below is an example connection url using default url using the default keystores and trust stores in WSO2 carbon productsESB:
| Code Block |
|---|
String connectionUrl = "amqp://admin:admin@carbon/carbon?brokerlist='tcp://localhost:8672?ssl='true'&ssl_cert_alias='RootCA'&trust_store='{MBESB_HOME}/repository/resources/security/client-truststore.jks'&trust_store_password='wso2carbon'&key_store='{MBESB_HOME}/repository/resources/security/wso2carbon.jks'&key_store_password='wso2carbon''"; |
| Info |
|---|
Before executing the client program, replace |
Configuring JMS Clients for Failover with SSL
For example, if you have configured a WSO2 Message Broker cluster, you might need to configure failover. If those broker nodes have different certs in place, when configuring a failover connection url at the client side, you can individually specify a client trust store and a keystore for each broker in the broker list. Or else, you can import the certs of all brokers in the cluster to a single trust store with different cert aliases and differentiate the cert to use when failing over by the alias.
Configure WSO2 ESB to communicate with WSO2 MB with SSL
To configure WSO2 ESB to communicate with MB with SSL, configure the SSL url above in the <ESB_HOME>/repository/conf/jndi.properties file.