Network Deployment (Distributed operating systems), v8.0 > Administer applications and their environment > Administer Messaging resources > Manage messaging with the default messaging provider > Use JMS from stand-alone clients to interoperate with service integration resources


Secure JMS client and JMS resource adapter connections

There are two approaches to configuring Secure Sockets Layer (SSL) for the Thin Client for JMS with WAS and the Resource Adapter for JMS with WAS . The global configuration approach affects all stand-alone outbound connections from the process, and the private approach applies only to client or resource adapter connections from the process.

The Thin Client for JMS with WAS and the Resource Adapter for JMS with WAS use the standard Java Secure Socket Extension (JSSE) that all supported JREs provide for making SSL connections. For information about JSSE, see the JSSE documentation.

The global configuration approach uses JRE global properties and affects all outbound SSL connections that the application initiates. For a JRE configured to use SSL connections to connect to WAS, you typically have to set the following javax.net.ssl system properties:

-Djavax.net.ssl.keyStore=key.p12
-Djavax.net.ssl.keyStorePassword={xor}Lz4sLCgwLTs=
-Djavax.net.ssl.trustStore=trust.p12
-Djavax.net.ssl.trustStorePassword={xor}PSo4LSov

You can use the private configuration approach to specify security settings that are specific to the Thin Client for JMS with WAS or the Resource Adapter for JMS with WAS connections. You can configure the com.ibm.ws.sib.client.ssl.properties system property to specify the location of an IBM SSL properties file. If this system property is not configured, an attempt is made load the properties file from the classpath instead.

The client obtains the value that it uses for any particular SSL property as follows:

The table below summarizes the IBM SSL property keys that can be configured inside the IBM SSL properties file, and the corresponding javax.net.ssl.* system property keys and default values.

IBM SSL property values and corresponding JRE global property and default values. The first column of the table lists the IBM SSL property keys and the second column lists the corresponding JRE global property keys. The third column provides the default values of the properties.

IBM SSL property JRE global property Default value
com.ibm.ssl.keyStoreType javax.net.ssl.keyStoreType JKS
com.ibm.ssl.keyStore javax.net.ssl.keyStore None
com.ibm.ssl.keyManager javax.net.ssl.keyStoreProvider IbmX509
com.ibm.ssl.trustManager javax.net.ssl.trustStoreProvider IbmX509
com.ibm.ssl.keyStorePassword javax.net.ssl.keyStorePassword None
com.ibm.ssl.protocol None SSL
com.ibm.ssl.contextProvider None IBMJSSE2
com.ibm.ws.sib.jsseProvider None com.ibm.jsse2.IBMJSSEProvider2
com.ibm.ssl.trustStore javax.net.ssl.trustStore None
com.ibm.ssl.trustStoreType javax.net.ssl.trustStoreType JKS
com.ibm.ssl.trustStorePassword javax.net.ssl.trustStorePassword None

For example, you might create an ssl.properties file that contains the following properties and values:

com.ibm.ssl.keyStore=/thinclient/key.p12
com.ibm.ssl.keyStoreType=PKCS12
com.ibm.ssl.keyStorePassword=WebAS
com.ibm.ssl.trustStore=/thinclient/trust.p12
com.ibm.ssl.trustStoreType=PKCS12
com.ibm.ssl.trustStorePassword=WebAS

We can use the PropFilePasswordEncoder tool in the WAS bin directory to encode passwords stored in plain text property files. For further information see Encode passwords in files.

Notes:

  1. SSL connections from SUN JREs that use the Thin Client for JMS with WAS cannot use the default WAS PKCS12 key and trust stores. If you are running the client securely from SUN JREs, first extract the certificates from the trust store by using an IBM software development kit (SDK). We can then import these certificates into a keystore that the Sun JRE can recognize correctly, such as a JKS keystore.
  2. SSL connections are not supported by the IBM JRE shipped with WAS - a non- WAS installed JRE must be used.


Procedure

  1. Obtain the necessary key and trust store files.

  2. Set the javax.net.ssl system properties required for the global configuration approach.

  3. For the private configuration approach, use the com.ibm.ws.sib.client.ssl.properties system property to specify the file from which the SSL properties are to be loaded, as shown in the following example:
    -Dcom.ibm.ws.sib.client.ssl.properties=c:/ssl.properties
    


Use JMS to connect to a WAS default messaging provider messaging engine
Use JMS from a third party application server to interoperate with service integration resources

+

Search Tips   |   Advanced Search