Search code examples
javasslapache-camelqpidapache-servicemix

Unable to load KeyStore file in Qpid config

I have a keystore file that works good. I have tested it using the below command :: 

root@server # java -Djavax.net.ssl.trustStore=/tmp/apache-servicemix-7.0.0/deploy/qpid.jks SSLPoke esesslx0ghk.se 9443 
Successfully connected

Now I am using ServiceMix to deploy a qpid applcation to route queues.

My config is as follows :: 

  <bean id="amqp" class="org.apache.camel.component.amqp.AMQPComponent">
    <property name="connectionFactory">
       <bean class="org.apache.qpid.jms.JmsConnectionFactory">
         <property name="remoteURI" value="amqps://esesslx0ghk.se:9443?transport.keyStoreLocation=/tmp/apache-servicemix-7.0.0/deploy/qpid.jks&amp;transport.keyStorePassword=test123" />
       </bean>
    </property>
  </bean>

But when I run my application, I get the ERROR :: 

2017-05-10 17:30:02,591 | ERROR | mer[CSDP_output] | JmsConnectionFactory             | 226 - qpid-jms-client.jar - 0.0.0 | Failed to create JMS Provider instance for: amqps 
2017-05-10 17:30:02,619 | ERROR | mer[CSDP_output] | faultJmsMessageListenerContainer | 155 - org.apache.servicemix.bundles.spring-jms - 3.2.17.RELEASE_1 | Could not refresh JMS Connection for destination 'CSDP_output' - retrying in 5000 ms. Cause: Failed to create connection to: amqps://esesslx0ghk.se:9443?transport.keyStoreLocation=%252Ftmp%252Fapache-servicemix-7.0.0%252Fdeploy%252Fqpidd.jks&transport.keyStorePassword=test123; nested exception is javax.net.ssl.SSLHandshakeException: General SSLEngine problem 
javax.jms.JMSException: Failed to create connection to: amqps://esesslx0ghk.se:9443?transport.keyStoreLocation=%252Ftmp%252Fapache-servicemix-7.0.0%252Fdeploy%252Fqpidd.jks&transport.keyStorePassword=test123 


Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem 
        at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1478)[:1.8.0_121] 
        at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)[:1.8.0_121] 
        at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)[:1.8.0_121] 
        at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)[:1.8.0_121] 
        at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)[:1.8.0_121] 


Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)[:1.8.0_121] 
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)[:1.8.0_121] 
        at sun.security.validator.Validator.validate(Validator.java:260)[:1.8.0_121] 
        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)[:1.8.0_121] 
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281)[:1.8.0_121] 
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)[:1.8.0_121] 
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1501)[:1.8.0_121] 
        ... 21 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
        at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)[:1.8.0_121] 
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)[:1.8.0_121]

Now on one hand I am 100% sure that the keystore file I have is correct and its path is properly configured. But the application is not able to pick it up. Is there something wrong with this line ? 

<property name="remoteURI" value="amqps://esesslx0ghk.se:9443?transport.keyStoreLocation=/tmp/apache-servicemix-7.0.0/deploy/qpidd.jks&amp;transport.keyStorePassword=test123" />
Solution

  • You are handing the client a key store but in general you should be handing it a trust store as that is what tells the client which server certificates it trusts. You only give a key store when you are doing mutual authentication and the client needs to provide a certificate to the remote.

    My first suggestion would be to set the transport.trustStoreLocation as defined in the client documentation.

    If that doesn't work then it's time to break down and do some debugging of the SSL handshake.