2

I have set up an ActiveMQ Artemis cluster (version 2.27.1) to use mutual authentication. When the second node tries to connect to the first one, I get an error

WARN  [org.apache.activemq.artemis.core.server] AMQ222208: SSL handshake failed for client from /10.226.95.134:46882: java.security.cert.CertificateException: No subject alternative names matching IP address 10.226.95.134 found.

The hostname of the client is in the SAN of the certificate in the truststore. I can't figure out how to configure the acceptor to use the hostname instead of the IP address.

The broker.xml configuration is

<acceptor name="netty-master-acceptor01">
tcp://dev-artemis01:61617?sslEnabled=true;needClientAuth=true;verifyHost=true;keyStorePath=/keys/keystore.jks;keyStorePassword=123;trustStorePath=/keys/trusted_keystore.jks;trustStorePassword=password;protocols=CORE,AMQP
</acceptor>

...

<connector name="netty-master-connector02">
tcp://artemis02:61617?sslEnabled=true;keyStorePath=/keys/keystore.jks;keyStorePassword=123;trustStorePath=/keys/trusted_keystore.jks;trustStorePassword=password
</connector>

I ran openssl commands between artemis01 and artemis02 servers and they worked

openssl s_server -accept 3000 -key dev_artemis.key -cert dev-artemis.pem -CAfile dev-artemis.pem -state

openssl s_client -connect dev-artemis01:3000 -key dev_artemis.key -cert dev-artemis.pem -CAfile dev-artemis.pem -state

How can I configure the acceptor to use hostnames (which are in the SAN) instead of the raw IP addresses?

Justin Bertram
  • 29,372
  • 4
  • 21
  • 43
Milind
  • 2,760
  • 1
  • 16
  • 12
  • not programming or development, but: `openssl` doesn't tell you anything useful here. `s_client` by default doesn't check the identity in a server cert, and `s_server` by default doesn't even request/obtain a client cert; if you specify `-verify` or `-Verify` to do client auth, it doesn't check the identity. (`s_client` always, and `s_server` with `-[vV]erify`, does check that the cert validates per RFC5280 except for revocation: chains to a trusted root with valid signatures, time within validity period, extensions like basicconstraints and keyusage correct, etc.) – dave_thompson_085 Sep 02 '23 at 19:13

0 Answers0