无法在 Qpid 配置中加载 KeyStore 文件

Question

我有一个运行良好的密钥库文件。我已经使用以下命令对其进行了测试：::

root@server # java -Djavax.net.ssl.trustStore=/tmp/apache-servicemix-7.0.0/deploy/qpid.jks SSLPoke esesslx0ghk.se 9443 
Successfully connected

现在我正在使用 ServiceMix 部署一个 qpid 应用程序来路由队列。

我的配置如下::

  <bean id="amqp" class="org.apache.camel.component.amqp.AMQPComponent">
    <property name="connectionFactory">
       <bean class="org.apache.qpid.jms.JmsConnectionFactory">
         <property name="remoteURI" value="amqps://esesslx0ghk.se:9443?transport.keyStoreLocation=/tmp/apache-servicemix-7.0.0/deploy/qpid.jks&amp;transport.keyStorePassword=test123" />
       </bean>
    </property>
  </bean>

但是当我运行我的应用程序时，我得到错误 ::

2017-05-10 17:30:02,591 | ERROR | mer[CSDP_output] | JmsConnectionFactory             | 226 - qpid-jms-client.jar - 0.0.0 | Failed to create JMS Provider instance for: amqps 
2017-05-10 17:30:02,619 | ERROR | mer[CSDP_output] | faultJmsMessageListenerContainer | 155 - org.apache.servicemix.bundles.spring-jms - 3.2.17.RELEASE_1 | Could not refresh JMS Connection for destination 'CSDP_output' - retrying in 5000 ms. Cause: Failed to create connection to: amqps://esesslx0ghk.se:9443?transport.keyStoreLocation=%252Ftmp%252Fapache-servicemix-7.0.0%252Fdeploy%252Fqpidd.jks&transport.keyStorePassword=test123; nested exception is javax.net.ssl.SSLHandshakeException: General SSLEngine problem 
javax.jms.JMSException: Failed to create connection to: amqps://esesslx0ghk.se:9443?transport.keyStoreLocation=%252Ftmp%252Fapache-servicemix-7.0.0%252Fdeploy%252Fqpidd.jks&transport.keyStorePassword=test123 


Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem 
        at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1478)[:1.8.0_121] 
        at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)[:1.8.0_121] 
        at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)[:1.8.0_121] 
        at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)[:1.8.0_121] 
        at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)[:1.8.0_121] 


Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)[:1.8.0_121] 
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)[:1.8.0_121] 
        at sun.security.validator.Validator.validate(Validator.java:260)[:1.8.0_121] 
        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)[:1.8.0_121] 
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281)[:1.8.0_121] 
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)[:1.8.0_121] 
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1501)[:1.8.0_121] 
        ... 21 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
        at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)[:1.8.0_121] 
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)[:1.8.0_121]

一方面，我 100% 确定我拥有的密钥库文件是正确的，并且其路径已正确配置。但是应用程序无法拾取它。这条线有什么问题吗？

<property name="remoteURI" value="amqps://esesslx0ghk.se:9443?transport.keyStoreLocation=/tmp/apache-servicemix-7.0.0/deploy/qpidd.jks&amp;transport.keyStorePassword=test123" />

Answer 1

您正在向客户端提供一个密钥库，但通常您应该向其提供一个信任库，因为它告诉客户端它信任哪些服务器证书。相互认证时只需要给key store，客户端需要提供证书给远端。

我的第一个建议是设置客户端 documentation 中定义的 transport.trustStoreLocation。

如果这不起作用，那么是时候分解并调试 SSL handshake。

无法在 Qpid 配置中加载 KeyStore 文件

Unable to load KeyStore file in Qpid config

java

ssl

apache-camel

qpid

apache-servicemix