方便的 SSL：在 IBM Lotus Expeditor 中结合使用 TLS/SSL 和微代理 v3

private final String BROKER_NAME = "MBroker";
private final int SECURE_PORT = 8883;
private final String KEYSTORE_DTEE = "/mbrokerdtee.jks";
private final char[] KSPASSWD_DTEE ={'d','e','f','a','u','l','t'};

void _addSecurePort() throws Exception
{
    BrokerFactory factory = BrokerFactory.INSTANCE;
    LocalBroker lbroker = factory.getByName(BROKER_NAME);
    Communications bc = lbroker.getCommunications();
    // Specify the port number in this method call. 8883 is the IANA
    // default port for secure MQTT connections.
    MQTTTCPListenerDefinition mqttld = 
                 bc.createMQTTTCPListenerDefinition(SECURE_PORT);
    mqttld.setSecure(true);
    ServerSSLDefinition ssld = mqttld.createSSLDefinition();
    ssld.setKeyStore(KEYSTORE_DTEE);
    ssld.setKeyStorePassword(KSPASSWD_DTEE);
    mqttld.setSSLDefinition(ssld);
    bc.addTCPListener(mqttld);
}

void createSecureBroker() throws Exception 
{
    BrokerFactory factory = BrokerFactory.INSTANCE;
    BrokerDefinition def = factory.createBrokerDefinition(BROKER_NAME);
    // setPort() is optional – 8883 is used if this method is not called
//  def.setPort(Integer.parseInt(SECURE_PORT));
    def.setDefaultListenerSecure(true);
    ServerSSLDefinition ssld = def.createSSLDefinition();
    ssld.setKeyStore(KEYSTORE_DTEE);
    ssld.setKeyStorePassword(KSPASSWD_DTEE);
    def.setSSLDefinition(ssld);
    factory.create(def);
}

private MqttClient myClient;
private static final String BROKER_URL = "ssl://localhost:8883";
private static final String CLIENT_ID = "AnonUser";

public void createClient() throws Exception
{
    // Define the connection options for the MQTTv5 client
    // We'll connect anonymously, so we don't set username/password
    MqttConnectOptions connOpts = new MqttConnectOptions();
    connOpts.setPurge(true);
    // Create the client object
    myClient = new MqttClient(BROKER_URL, CLIENT_ID);
    // We've created the client. For normal use, we'd also define and set
    // a callback handler, but we're only connecting so won't bother.
    myClient.connect(connOpts);
}

private final String BROKER_NAME = "LocalBroker";
private final int REMOTE_SECURE_PORT = 8883;

public void _createSecurePipe(CommandInterpreter ci) throws Exception
{
    BrokerFactory factory = BrokerFactory.INSTANCE;
    LocalBroker lbroker = factory.getByName(BROKER_NAME);
    bridge = lbroker.getBridge();
    PipeDefinition pipeDef = bridge.createPipeDefinition("securePipe");
    MQTTConnectionDefinition secBridge = 
                bridge.createMQTTConnectionDefinition("secConn");
    // Uncomment this method call for an MQTTv3 connection
//  secBridge.setProtocolVersion(3);
    secBridge.setHost("localhost");
    secBridge.setPort(REMOTE_SECURE_PORT);
    secBridge.setSecure(true);
    pipeDef.setConnection(secBridge);
    // A pipe has to have at least one flow...
    FlowDefinition outflow = bridge.createFlowDefinition("secureflow");
    outflow.setSources(new DestinationDefinition[]{
                bridge.createTopicDefinition("SSLBridge/#")});
    outflow.setQos(2);
    pipeDef.addOutboundFlow(outflow);
    Pipe pipe = bridge.addPipe(pipeDef);
    pipe.start();
}

>Info [1240] FMBB2006 bridge Pipe securePipe initializing.
>Info [1240] FMBB2004 bridge Pipe securePipe starting. 
>Info [1240] FMBB2000 bridge Pipe securePipe started. 
>Info [1240] FMBB2628 bridge Pipe securePipe has established its outbound connection.
			

private final String BROKER_NAME = "MBroker";
private final int SECURE_PORT = 8883;
private final String KEYSTORE_DTEE = "/mbrokerdtee.jks";
private final char[] KSPASSWD_DTEE ={'d','e','f','a','u','l','t'};

void _addSecurePort() throws Exception
{
    BrokerFactory factory = BrokerFactory.INSTANCE;
    LocalBroker lbroker = factory.getByName(BROKER_NAME);
    Communications bc = lbroker.getCommunications();
    // Specify the port number in this method call. 8883 is the IANA
    // default port for secure MQTT connections.
    MQTTTCPListenerDefinition mqttld = 
                 bc.createMQTTTCPListenerDefinition(SECURE_PORT);
    mqttld.setSecure(true);
    ServerSSLDefinition ssld = mqttld.createSSLDefinition();
    ssld.setKeyStore(KEYSTORE_DTEE);
    ssld.setKeyStorePassword(KSPASSWD_DTEE);
    ssld.setClientCertificateRequired(true);
    mqttld.setSSLDefinition(ssld);
    bc.addTCPListener(mqttld);
}

void createSecureBroker() throws Exception 
{
    BrokerFactory factory = BrokerFactory.INSTANCE;
    BrokerDefinition def = factory.createBrokerDefinition(BROKER_NAME);
    // setPort() is optional – 8883 is used if this method is not called
//  def.setPort(Integer.parseInt(SECURE_PORT));
    def.setDefaultListenerSecure(true);
    ServerSSLDefinition ssld = def.createSSLDefinition();
    ssld.setKeyStore(KEYSTORE_DTEE);
    ssld.setKeyStorePassword(KSPASSWD_DTEE);
    ssld.setClientCertificateRequired(true);
    def.setSSLDefinition(ssld);
    factory.create(def);
}

> 2009/01/05 14:39:11.843 SEVERE FMBB2117 bridge MQTT connection for the pipe 
securePipe threw an MqttException. 
> 2009/01/05 14:39:11.859 WARNING FMBB2098 bridge Connector Class loading 
threw the exception  (0) - javax.net.ssl.SSLHandshakeException: The operation timed 
out for the Pipe securePipe 
			

Enter store password:
changeit
Owner : CN=MB Client,OU=PVC,O=IBM,C=UK
Issuer : CN=MB Client,OU=PVC,O=IBM,C=UK
Serial number : 4962101e
Valid from Mon Jan 05 13:50:22 GMT 2009 to Sun Apr 05 14:50:22 BST 2009
Certificate fingerprints :
  [MD5]   : a4:ab:83:af:14:2b:40:ae:a8:f4:67:92:d7:48:28:f8
  [SHA-1] : a4:13:05:4a:b2:12:96:ee:35:ee:fd:a8:ef:83:dc:bc:0e:27:44:32

Do you trust this certificate? [no]:
				 yes
			

Enter store password: 
changeit
clientcert, Mon Jan 05 15:31:51 GMT 2009, 
trusted certificate entry, Certificate fingerprint:
  [MD5]   : a4:ab:83:af:14:2b:40:ae:a8:f4:67:92:d7:48:28:f8
			

Enter store password: 
default
Keystore type: jks
Keystore provider: OTI

Keystore contains 1 entry:

clientcert, Mon Jan 05 13:50:22 GMT 2009, key entry,
Certificate fingerprint:
  [MD5]   : a4:ab:83:af:14:2b:40:ae:a8:f4:67:92:d7:48:28:f8
			

private MqttClient myClient;
private static final String BROKER_URL = "ssl://localhost:8883";
private static final String CLIENT_ID = "AnonUser";
private static final String CLIENT_KS = “clientdtee.jks";
private static final String CLIENT_KSPW = “default”:

public void createClient() throws Exception
{
    // Define the connection options for the MQTTv5 client
    // We'll connect anonymously, so we don't set username/password
    MqttConnectOptions connOpts = new MqttConnectOptions();
    connOpts.setPurge(true);
    // Now set the SSL properties for the client
    Properties sslprops = new Properties();
    sslprops.setProperty("com.ibm.ssl.keyStore", CLIENT_KS);
    sslprops.setProperty("com.ibm.ssl.keyStorePassword", CLIENT_KSPW);
    connOpts.setSSLProperties(sslprops);
    // Finally create the client object
    myClient = new MqttClient(BROKER_URL, CLIENT_ID);
    // We've created the client. For normal use, we'd also define and set
    // a callback handler, but we're only connecting so won't bother.
    myClient.connect(connOpts);
}

private final String BROKER_NAME = "LocalBroker";
private final int REMOTE_SECURE_PORT = 8883;
private static final String BRIDGE_KS = “clientdtee.jks";
private static final String BRIDGE_KSPW = “default”:

public void _createSecurePipe(CommandInterpreter ci) throws Exception
{
    BrokerFactory factory = BrokerFactory.INSTANCE;
    LocalBroker lbroker = factory.getByName(BROKER_NAME);
    bridge = lbroker.getBridge();
    PipeDefinition pipeDef = bridge.createPipeDefinition("securePipe");
    MQTTConnectionDefinition secBridge = 
                bridge.createMQTTConnectionDefinition("secConn");
    // Uncomment this method call for an MQTTv3 connection
//  secBridge.setProtocolVersion(3);
    secBridge.setHost("localhost");
    secBridge.setPort(REMOTE_SECURE_PORT);
    secBridge.setSecure(true);
    SSLDefinition ssld = secBridge.createSSLDefinition();
    ssld.setKeyStore(BRIDGE_KS);
    ssld.setKeyStorePassword(BRIDGE_KSPW.toCharArray());
    secBridge.setSSLDefinition(ssld);
    pipeDef.setConnection(secBridge);
    // A pipe has to have at least one flow...
    FlowDefinition outflow = bridge.createFlowDefinition("secureflow");
    outflow.setSources(new DestinationDefinition[]{
                bridge.createTopicDefinition("SSLBridge/#")});
    outflow.setQos(2);
    pipeDef.addOutboundFlow(outflow);
    Pipe pipe = bridge.addPipe(pipeDef);
    pipe.start();
}

private final String BROKER_NAME = "MBroker";
private String mqhost = "swtest.hursley.ibm.com";
private int mqport = 1414;
private String qmgr = "swtest";

public void _createSecureMqPipe() throws Exception
{
    BrokerFactory factory = BrokerFactory.INSTANCE;
    LocalBroker lbroker = factory.getByName(BROKER_NAME);
    bridge = lbroker.getBridge();
    PipeDefinition pipeDef = bridge.createPipeDefinition("secureMqPipe");
    MQJMSConnectionDefinition remote = 
        bridge.createMQJMSConnectionDefinition("remote");
    remote.setHost(mqhost);
    remote.setPort(mqport); 
    remote.setQueueManager(qmgr);
    remote.setChannel("SECURE.CHANNEL");
    remote.setSecure(true);
    SSLDefinition ssld = remote.createSSLDefinition();
    ssld.setEnabledCipherSuites(new String[]{
        "SSL_RSA_WITH_RC4_128_SHA"}); 
    remote.setSSLDefinition(ssld);
    pipeDef.setConnection(remote);

    // A pipe has to have at least one flow...
    FlowDefinition outflow = bridge.createFlowDefinition("secureflow");
    outflow.setSources(new DestinationDefinition[]{
                bridge.createTopicDefinition("SSLBridge/#")});
    outflow.setQos(2);
    pipeDef.addOutboundFlow(outflow);
    Pipe pipe = bridge.addPipe(pipeDef);
    pipe.start();
}

private final String BROKER_NAME = "MBroker";
private final int SECURE_PORT = 8883;
private final String KEYSTORE_DTEE = "/mbrokerdtee.jks";
private final char[] KSPASSWD_DTEE ={'d','e','f','a','u','l','t'};

void _addSecurePort() throws Exception
{
    BrokerFactory factory = BrokerFactory.INSTANCE;
    LocalBroker lbroker = factory.getByName(BROKER_NAME);
    Communications bc = lbroker.getCommunications();
    // Specify the port number in this method call. 8883 is the IANA
    // default port for secure MQTT connections.
    MQTTTCPListenerDefinition mqttld = 
                 bc.createMQTTTCPListenerDefinition(SECURE_PORT);
    mqttld.setSecure(true);
    ServerSSLDefinition ssld = mqttld.createSSLDefinition();
    ssld.setKeyStore(KEYSTORE_DTEE);
    ssld.setKeyStorePassword(KSPASSWD_DTEE);
    mqttld.setNetworkInterface("127.0.0.1");
    mqttld.setSSLDefinition(ssld);
    bc.addTCPListener(mqttld);
}