Enabling SSL

Allowing SSL access to the ActiveMQ broker is done by adding a suitable transport connector to the activemq.xml configuration file:

    <transportConnectors>
        <transportConnector uri="ssl://0.0.0.0:61617?trace=true&amp;wantClientAuth=true&amp;needClientAuth=true"/>
    </transportConnectors>

After restarting the broker it will accept connections on port 61617 (in this case) on any interface (Indicated by 0.0.0.0). Additionally client authentication will be enabled, which requires a truststore to be set up (see below).

Specifying the location of the key and trust stores used by the server is done in the sslContext section of the same configuration file (but must be placed above transportConnectors?):

    <sslContext>
        <sslContext keyStore="file://${activemq.base}/data/broker.ks"
                    keyStorePassword="123456"
                    trustStore="file://${activemq.base}/data/broker.ts"
                    trustStorePassword="123456"/>
    </sslContext>

Since multiple brokers on the same machine will probably want to share the same key and trust stores it might be advantageous to place the keys in ${activemq.home}/data.

Using OpenSSL keys with the broker:

$ cd /path/to/instance/data

    # Convert the broker key and certificate to PKCS12 format
$ openssl pkcs12 -export -in broker.crt -inkey broker.key -out broker.p12

    # Import the server key from the p12 file
$ keytool -importkeystore
          -srckeystore broker.p12 \
          -srcstoretype pkcs12    \
          -destkeystore broker.ks \
          -storepass 123456       \

    # Import the CA certificate into the trust store.
$ keytool -keystore broker.ts \
          -storepass 123456   \
          -import -alias CA   \
          -file /path/to/ca.crt

Below are some another examples of usage of keytool:

$ keytool -genkey -alias broker \
          -keyalg RSA           \
          -keystore broker.ks     # Generate broker certificate and key

$ keytool -export -alias broker \
          -keystore broker.ks   \
           -file broker_cert      # Export certificate for import into client trust store

$ keytool -genkey -alias client \
          -keyalg RSA           \
          -keystore client.ks     # Generate client key and certificate

$ keytool -import -alias broker \
          -keystore client.ts   \
          -file broker_cert       # Import server certificate in client trust store

$ keytool -export -alias client \
          -keystore client.ks   \
          -file client_cert       # Export client certificate for server trust store

$ keytool -import -alias client \
          -keystore broker.ts   \
          -file client_cert       # Import client certificate in server trust store

    # Import client key to server
$ openssl x509 -in client.pem -out client.der -outform der
$ keytool  -importcert -alias client -keystore broker.ks -storepass <pass> -file client.der

ActiveMQ reference "How Do I Use SSL?"