Authenticating an SSL telemetry connection using self-signed certificates
Use self-signed certificates generated using Keytool to authenticate an SSL connection. You have the option of authenticating the telemetry channel, or the telemetry channel and the clients that attach to it. Messages flowing on the connection are encrypted.
Before you begin
Do the task, Creating your first MQ Telemetry Transport publisher application using Java before you start, to get PubSync.java working with an unsecured TCP/IP connection. In this task, you modify PubSync.java to work with an SSL connection.
About this task
The steps in the task are written as a programming exercise. You must adapt the procedure to perform real authentication in a production environment.
The task is written for Windows. Change the directory paths for Linux®.
Procedure
Modifying PubSync.java to use SSL
Modify the first publisher program example to connect to a telemetry channel using SSL. Set the SSL properties used by the modified program.
Before you begin
You are assumed to have installed the MQTT v3 client jar files, Javadoc, Eclipse, configured telemetry channels and coded and run PubSync.java before performing this task. You have an Eclipse workspace that includes a running version of PubSync.java.
About this task
The task uses the publisher client, PubSync.java, you created in Creating your first MQ Telemetry Transport publisher application using Java as a base. Only small modifications are necessary to use SSL; see Figure 1 and Figure 2.
Procedure
Examples
The modifications to PubSync.java to add SSL are shown in Figure 1 in italics.package com.ibm.mq.id;
import com.ibm.micro.client.mqttv3.*;
public class PubSyncSSL {
public static void main(String[] args) {
try {
MqttClient client = new MqttClient(Example.SSLAddress, Example.clientId);
MqttTopic topic = client.getTopic(Example.topicString);
MqttMessage message = new MqttMessage(Example.publication.getBytes());
message.setQos(Example.QoS);
MqttConnectOptions conOptions = new MqttConnectOptions();
conOptions.setSSLProperties(Example.getSSLSettings());
client.connect(conOptions);
System.out.println("Waiting for up to " + Example.sleepTimeout / 1000
+ " seconds for publication of \"" + message.toString()
+ "\" with QoS = " + message.getQos());
System.out.println("On topic \"" + topic.getName() + "\" for client instance: \""
+ client.getClientId() + "\" on address " + client.getServerURI() + "\"");
System.out.println("SSL Properties" + conOptions.getSSLProperties());
MqttDeliveryToken token = topic.publish(message);
token.waitForCompletion(Example.sleepTimeout);
System.out.println("Delivery token \"" + token.hashCode()
+ "\" has been received: " + token.isComplete());
client.disconnect();
} catch (Exception e) {
System.out.println("Client exception caught");
e.printStackTrace();
}
}
} public static final String SSLAddress =
System.getProperty("SSLAddress", "ssl://localhost:8883");
public static final Properties getSSLSettings() {
final Properties properties = new Properties();
properties.setProperty("com.ibm.ssl.keyStore", "C:\\Certificates\\SSClientKey.jks");
properties.setProperty("com.ibm.ssl.keyStoreType", "JKS");
properties.setProperty("com.ibm.ssl.keyStorePassword", "password");
properties.setProperty("com.ibm.ssl.trustStore", "C:\\Certificates\\SSClientTrust.jks");
properties.setProperty("com.ibm.ssl.trustStoreType", "JKS");
properties.setProperty("com.ibm.ssl.trustStorePassword", "password");
return properties;Authenticating the telemetry channel
Clients authenticate the telemetry channel to encrypt the contents of the messages flowing on the channel, and to ensure a client connects to the correct telemetry channel. The server does not authenticate the client.
About this task
You can use a number of different keystore editors to create and manage self-signed certificates. The task uses the command line keytool command, which is part of the JRE. You can use the GUI tool iKeyman, which is shipped with WebSphere MQ to browse keystores and generate keys. Launch iKeyman using the command strmqikm.
Procedure
Authenticating the telemetry channel and clients
Clients authenticate the telemetry channel and the telemetry channel authenticates clients attaching to it. Messages flowing on the channel are encrypted.
About this task
You can use a number of different keystore editors to create and manage self-signed certificates. The task uses the command line keytool command, which is part of the JRE. You can use the GUI tool iKeyman, which is shipped with WebSphere MQ to browse keystores and generate keys. Launch iKeyman using the command strmqikm.
The telemetry channel is configured with a different keystore to the task, Authenticating the telemetry channel. You can use the same keystore, and omit step 2 to add keys to the keystore.