我正在尝试使用 jconsole 远程连接到应用程序。如果没有 SSL,我的配置可以正常工作。
我在要访问的服务器上创建了一个公钥:
sudo keytool -keystore broker.ks -alias broker -genkey -keyalg RSA
然后我导出了证书:
sudo keytool -export -alias broker -keystore broker.ks -file broker_cert.crt
客户端我创建一个信任库并导入证书:
-import -alias broker -keystore broker.ts -file broker_cert.crt
然后我启动我的代理服务器端,如下所示:
java \
-Xms1024M \
-Xmx1024M \
-Dcom.sun.management.jmxremote.port=1099 \
-Dcom.sun.management.jmxremote.password.file=/etc/activemq/jmx.password \
-Dcom.sun.management.jmxremote.access.file=/etc/activemq/jmx.access \
-Dcom.sun.management.jmxremote \
-jar broker.jar \
-Djavax.net.ssl.keyStore=/etc/activemq/broker.ks \
-Djavax.net.ssl.keyStorePassword=password
正如我所提到的,密码配置可以正常工作,因为我可以在将 jmxremote.ssl 设置为 false 时进行连接。
客户端然后我像这样启动 jconsole:
jconsole -J-Djavax.net.ssl.trustStore=/etc/activemq/broker.ts -J-Djavax.net.ssl.trustStorePassword=password -J-Djava.util.logging.config.file=/etc/activemq/logging.properties
尝试连接到服务器时,日志给我以下错误:
failed to connect: java.rmi.ConnectIOException: error during JRMP connection establishment; nested exception is:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
为了详细说明这一点,我的证书肯定设置正确。我可以在 /etc/activemq 中执行的服务器端:
keytool -list -keystore broker.ks
并收到:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 1 entry
broker, 01-May-2012, PrivateKeyEntry,
Certificate fingerprint (MD5): 30:55:60:4A:B5:85:D0:C5:2C:E9:DD:AD:1E:92:BE:6E
/etc/activemq 中的客户端我可以输入:
keytool -list -keystore broker.ks
并收到:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 1 entry
broker, May 3, 2012, trustedCertEntry,
Certificate fingerprint (MD5): 30:55:60:4A:B5:85:D0:C5:2C:E9:DD:AD:1E:92:BE:6E
如您所见,证书指纹匹配。更令人沮丧的是,当我启动 jconsole 时,我可以输入一个完全虚假的路径,-J-Djavax.net.ssl.trustStore=<boguspathhere>
但我收到的错误与我输入正确路径时完全相同 /etc/activemq/broker.ts
- 我希望日志至少能告诉我它是否有找到信任商店与否!而不是仅仅给予
failed to connect: java.rmi.ConnectIOException: error during JRMP connection establishment; nested exception is:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
呸呸呸