Блог

Я использую JMS в клиенте Spring boot для подключения к брокеру ActiveMQ Artemis 2.19.0 по протоколу SSL.

В broker.xml я использую пароли-маски, например ENC(32c6f67da12342b0a7ad1702033aa81e6b2a760123f4360) , вместо обычного текста, и он работает нормально.

Я попытался использовать тот же пароль маски вместо обычного текста в моем URL-адресе подключения ActiveMQ, как в приведенном ниже коде, но это не сработало. Я использую эту команду для маскировки пароля:

 ./artemis mask <plaintextPassword>
 

Обычный текстовый пароль работает.

Вот мой код для настройки фабрики соединений:

 ActiveMQConnectionFactory factory = new ActiveMQConnectionFactory(
        "(tcp://amq:61616)?"  
                "sslEnabled=true"  
                "amp;trustStorePath="   trustStorePath   "amp;trustStorePassword=ENC(397e3aeeddf27c9783a3ab920d83e24da5b7d710df3b405f)"
);
 

Ошибка, которую я получаю:

 
2021-10-27 13:10:15.243  WARN 17748 --- [-netty-threads)] io.netty.channel.ChannelInitializer      : Failed to initialize a channel. Closing: [id: 0x07b0d96b]

java.io.IOException: keystore password was incorrect
        at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2116) ~[na:na]
        at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:243) ~[na:na]
        at java.base/java.security.KeyStore.load(KeyStore.java:1479) ~[na:na]
        at org.apache.activemq.artemis.core.remoting.impl.ssl.SSLSupport.loadKeystore(SSLSupport.java:224) ~[artemis-core-client-2.6.4.jar!/:2.6.4]
        at org.apache.activemq.artemis.core.remoting.impl.ssl.SSLSupport.loadTrustManagerFactory(SSLSupport.java:166) ~[artemis-core-client-2.6.4.jar!/:2.6.4]
        at org.apache.activemq.artemis.core.remoting.impl.ssl.SSLSupport.loadTrustManager(SSLSupport.java:195) ~[artemis-core-client-2.6.4.jar!/:2.6.4]
        at org.apache.activemq.artemis.core.remoting.impl.ssl.SSLSupport.createContext(SSLSupport.java:99) ~[artemis-core-client-2.6.4.jar!/:2.6.4]
        at org.apache.activemq.artemis.core.remoting.impl.netty.NettyConnector.loadJdkSslEngine(NettyConnector.java:624) ~[artemis-core-client-2.6.4.jar!/:2.6.4]
        at org.apache.activemq.artemis.core.remoting.impl.netty.NettyConnector.access$500(NettyConnector.java:124) ~[artemis-core-client-2.6.4.jar!/:2.6.4]
        at org.apache.activemq.artemis.core.remoting.impl.netty.NettyConnector$1.initChannel(NettyConnector.java:532) ~[artemis-core-client-2.6.4.jar!/:2.6.4]
        at io.netty.channel.ChannelInitializer.initChannel(ChannelInitializer.java:129) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.ChannelInitializer.handlerAdded(ChannelInitializer.java:112) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.AbstractChannelHandlerContext.callHandlerAdded(AbstractChannelHandlerContext.java:964) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.DefaultChannelPipeline.callHandlerAdded0(DefaultChannelPipeline.java:610) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.DefaultChannelPipeline.access$100(DefaultChannelPipeline.java:46) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.DefaultChannelPipeline$PendingHandlerAddedTask.execute(DefaultChannelPipeline.java:1474) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.DefaultChannelPipeline.callHandlerAddedForAllHandlers(DefaultChannelPipeline.java:1126) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.DefaultChannelPipeline.invokeHandlerAddedIfNeeded(DefaultChannelPipeline.java:651) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.AbstractChannel$AbstractUnsafe.register0(AbstractChannel.java:503) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.AbstractChannel$AbstractUnsafe.access$200(AbstractChannel.java:416) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.AbstractChannel$AbstractUnsafe$1.run(AbstractChannel.java:475) ~[netty-transport-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163) ~[netty-common-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:416) ~[netty-common-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:331) ~[netty-transport-native-epoll-4.1.39.Final-linux-x86_64.jar!/:4.1.39.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:918) ~[netty-common-4.1.39.Final.jar!/:4.1.39.Final]
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[netty-common-4.1.39.Final.jar!/:4.1.39.Final]
        at org.apache.activemq.artemis.utils.ActiveMQThreadFactory$1.run(ActiveMQThreadFactory.java:118) ~[artemis-commons-2.6.4.jar!/:2.6.4]
Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
        ... 27 common frames omitted
 

Может ли быть другой способ использовать пароль маски вместо обычного текста в URL-адресе подключения?

Клиент ActiveMQ Artemis не поддерживает зашифрованные пароли в составных URL (tcp://amq:61616)? -адресах, см. ARTEMIS-3543. Обходной путь заключается в том, чтобы избежать фрагментов, т.е.

 ActiveMQConnectionFactory factory = new ActiveMQConnectionFactory(
    "tcp://amq:61616?"  
            "sslEnabled=true"  
            "amp;trustStorePath="   trustStorePath   "amp;trustStorePassword=ENC(397e3aeeddf27c9783a3ab920d83e24da5b7d710df3b405f)"
);