Skip to content

Latest commit

 

History

History
181 lines (118 loc) · 4.11 KB

qpidd.rst

File metadata and controls

181 lines (118 loc) · 4.11 KB
Raw

QPID Configuration

This page describes qpidd SSL configuration.

LINKS

Here are some helpful links:

RPMS

The SSL configuration for QPID is based on NSS. So, the certutil tool needs to be installed to manage the NSS certificate databases. Also, the qpidd-ssl package needs to be installed to enable SSL on the qpid broker.

Fedora:

  • nss-tools - contains certutil used to manage NSS database for SSL.
  • qpidd-ssl - contains ssl.so which enables SSL.

Certificates

The easiest way to create the NSS DB and SSL certificates needed, is to run the nss-db-gen in <gofer.git>/tools.

[jortel@~]$ cd git/gofer/tools
[jortel@localhost tools]$ nss-db-gen
bash: nss-db-gen: command not found
[jortel@localhost tools]$ ./nss-db-gen

Working in: /tmp/tmp20823


Please specify a directory into which the created NSS database
and associated certificates will be installed.

Enter a directory [/tmp/redhat/qpid]:
/tmp/redhat/qpid

Enter NSS database password:

Please specify a CA.  Generated if not specified.

Enter a path:

Password file created.

Database created.

Creating CA certificate:


Generating key.  This may take a few moments...

CA created

Creating BROKER certificate:


Generating key.  This may take a few moments...

Broker certificate created.

Creating CLIENT certificate:


Generating key.  This may take a few moments...

Client certificate created.
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":
Enter password for PKCS12 file:
Re-enter password:
pk12util: PKCS12 EXPORT SUCCESSFUL
Enter Import Password:
MAC verified OK
Client key & certificate exported

Artifacts copied to: /tmp/redhat/qpid.

Please update /etc/qpidd.conf as follows:

....
auth=no
....
# SSL
require-encryption=yes
ssl-require-client-authentication=yes
ssl-cert-db=/tmp/redhat/qpid/nss
ssl-cert-password-file=/tmp/redhat/qpid/nss/password
ssl-cert-name=broker
ssl-port=5674
...


Please configure gofer as follows:

...
[messaging]
url=ssl://<host>:5674
cacert=/tmp/redhat/qpid/ca.crt
clientcert=/tmp/redhat/qpid/client.crt

Files generated by the script:

redhat/
redhat/qpid
redhat/qpid/broker.crt
redhat/qpid/client.crt
redhat/qpid/nss
redhat/qpid/nss/secmod.db
redhat/qpid/nss/password
redhat/qpid/nss/key3.db
redhat/qpid/nss/cert8.db
redhat/qpid/ca.crt

Notes:

  • The "Enter a directory [/tmp/redhat/qpid]:" can be defined as any directory.
  • The passwords can be anything.

Configuration

QPID

Edit /etc/qpidd.conf:

auth

Require authentication. (value: no)

require-encryption

Require all connections to use SSL. (value: yes)

ssl-require-client-authentication

Require client SSL certificates for all SSL connections. (value: yes)

ssl-cert-db

The fully qualified path to the NSS DB. (example: /tmp/redhat/qpid/nss)

ssl-cert-password-file

The fully qualified path to the password file used to access the NSS DB. (example: /tmp/redhat/qpid/nss/password)

ssl-cert-name

The name of the certificate in the NSS DB to be used by the qpid broker. (example: broker)

ssl-port

The port to be use for SSL connections. (example: 5671)

Gofer Agent

Edit /etc/gofer/plugins/<yourplugin>.conf and under the [messaging] section:

url

The URL to the qpid broker. Protocol choices: tcp=plain, ssl=SSL. (example: ssl://<host>:5671)

cacert

The fully qualified path to the CA certificate used to validate the broker. (example: /tmp/redhat/qpid/ca.crt)

clientcert

The fully qualified path a file containing both the client private key and certificate. (example: /tmp/redhat/qpid/client.crt)