cd ...\examples\secure-socket |
ant |
$ ant Buildfile: build.xml identify: [echo] ############################################################################ [echo] # Running the SECURE SOCKET example # [echo] ############################################################################ [echo] The queue: testQueue sanity-check: init: [mkdir] Created dir: C:\work\src\cvs\jboss-head\jms\docs\examples\secure-socket\output [mkdir] Created dir: C:\work\src\cvs\jboss-head\jms\docs\examples\common\output compile: [javac] Compiling 2 source files to C:\work\src\cvs\jboss-head\jms\docs\examples\common\output [javac] Compiling 1 source file to C:\work\src\cvs\jboss-head\jms\docs\examples\secure-socket\output deploy: [copy] Copying 1 file to C:\jboss-4.0.4.GA\server\messaging\deploy\jboss-messaging.sar [copy] Copying 1 file to C:\jboss-4.0.4.GA\server\messaging\deploy sleep: [echo] Sleeping for 10 seconds ... run: [java] Queue /queue/testQueue exists [java] The message was successfully sent to the testQueue queue [java] Received message: Hello! [java] The example connected to JBoss Messaging version 1.0.1.GA (1.0) [java] ##################### [java] ### SUCCESS! ### [java] ##################### BUILD SUCCESSFUL Total time: 15 seconds |
<?xml version="1.0" encoding="UTF-8"?> <!-- Secure Socket Transport Example: the deployment descriptor for the secure socket factory service, secure connector and secure connection factory. $Id: remoting-service.xml,v 1.2 2006/05/08 21:35:35 ovidiu Exp $ --> <server> <loader-repository>jboss.messaging:loader=ScopedLoaderRepository <loader-repository-config>java2ParentDelegation=false</loader-repository-config> </loader-repository> <mbean code="org.jboss.remoting.transport.Connector" name="jboss.messaging:service=Connector,transport=SSLSocket" display-name="SSL Socket Transport Connector"> <attribute name="Configuration"> <config> <invoker transport="sslsocket"> <attribute name="marshaller" isParam="true">org.jboss.jms.server.remoting.JMSWireFormat</attribute> <attribute name="unmarshaller" isParam="true">org.jboss.jms.server.remoting.JMSWireFormat</attribute> <attribute name="serializationtype" isParam="true">jboss</attribute> <attribute name="dataType" isParam="true">jms</attribute> <attribute name="socket.check_connection" isParam="true">false</attribute> <attribute name="timeout">0</attribute> <attribute name="serverBindAddress">${jboss.bind.address}</attribute> <attribute name="serverBindPort">5457</attribute> <attribute name="leasePeriod">20000</attribute> <attribute name="serverSocketFactory"> jboss.messaging:service=ServerSocketFactory,type=SSL </attribute> </invoker> <handlers> <handler subsystem="JMS"> org.jboss.jms.server.remoting.JMSServerInvocationHandler</handler> </handlers> </config> </attribute> <depends>jboss.messaging:service=ServerSocketFactory,type=SSL</depends> </mbean> <mbean code="org.jboss.jms.server.connectionfactory.ConnectionFactory" name="jboss.messaging.destination:service=SecureConnectionFactory" xmbean-dd="xmdesc/ConnectionFactory-xmbean.xml"> <depends optional-attribute-name="ServerPeer">jboss.messaging:service=ServerPeer</depends> <depends optional-attribute-name="Connector"> jboss.messaging:service=Connector,transport=SSLSocket </depends> <attribute name="JNDIBindings"> <bindings> <binding>/SecureConnectionFactory</binding> </bindings> </attribute> </mbean> <!-- This section is for custom (SSL) server socket factory --> <!-- The server socket factory mbean to be used as attribute to socket invoker (see serverSocketFactory attribute above for where it is used). This service provides the exact same API as the ServerSocketFactory, so can be set as an attribute of that type on any MBean requiring an ServerSocketFactory. --> <mbean code="org.jboss.remoting.security.SSLServerSocketFactoryService" name="jboss.messaging:service=ServerSocketFactory,type=SSL" display-name="SSL Server Socket Factory"> <depends optional-attribute-name="SSLSocketBuilder" proxy-type="attribute">jboss.messaging:service=SocketBuilder,type=SSL</depends> </mbean> <!-- This service is used to build the SSL Server socket factory. This will be where all the store/trust information will be set. If do not need to make any custom configurations, no extra attributes need to be set for the SSLSocketBuilder and just need to set the javax.net.ssl.keyStore and javax.net.ssl.keyStorePassword system properties. This can be done by just adding something like the following to the run script for JBoss (this one is for run.bat): set JAVA_OPTS=-Djavax.net.ssl.keyStore=.keystore -Djavax.net.ssl.keyStorePassword=opensource %JAVA_OPTS% Otherwise, if want to customize the attributes for SSLSocketBuilder, will need to uncomment them below. --> <mbean code="org.jboss.remoting.security.SSLSocketBuilder" name="jboss.messaging:service=SocketBuilder,type=SSL" display-name="SSL Server Socket Factory Builder"> <!-- IMPORTANT - If making ANY customizations, this MUST be set to false. Otherwise, will used default settings and the following attributes will be ignored. --> <attribute name="UseSSLServerSocketFactory">false</attribute> <!-- This is the url string to the key store to use --> <attribute name="KeyStoreURL">messaging.keystore</attribute> <!-- The password for the key store --> <attribute name="KeyStorePassword">secureexample</attribute> <!-- The password for the keys (will use KeystorePassword if this is not set explicitly. --> <attribute name="KeyPassword">secureexample</attribute> <!-- The protocol for the SSLContext. Default is TLS. --> <attribute name="SecureSocketProtocol">TLS</attribute> <!-- The algorithm for the key manager factory. Default is SunX509. --> <attribute name="KeyManagementAlgorithm">SunX509</attribute> <!-- The type to be used for the key store. Defaults to JKS. Some acceptable values are JKS (Java Keystore - Sun's keystore format), JCEKS (Java Cryptography Extension keystore - More secure version of JKS), and PKCS12 (Public-Key Cryptography Standards #12 keystore - RSA's Personal Information Exchange Syntax Standard). These are not case sensitive. --> <attribute name="KeyStoreType">JKS</attribute> </mbean> </server> |
keytool -genkey -alias messaging.keypair -keyalg RSA -keystore messaging.keystore -validity 3650 |
By default, the client will try to contact a Certificate Authority
to
insure the authenticity of the public key it uses to encrypt the
communication. However, the example's certificate is self-signed, so no
Certificate Authority will
recognize it. In order to get the SSL client to trust it and the
example to complete successfully, we use a client truststore (/etc/messaging.truststore). In
case you need to create your own truststore, this is how you do it:
keytool -export -alias messaging.keypair -keystore messaging.keystore -rfc -file messaging.cer |
In order for the truststore to be recognized, the client's
environment must contain the javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword
properties.