Setting up the Key and Trust Stores

Also see Tomcat's SSL instructions for more info. The following was provided by Colin Kilburn. Thanks Colin!

ActiveMQ uses dummy credentials by default


ActiveMQ includes key and trust stores that reference a dummy self signed cert. When you create a broker certificate and stores for your installation, either overwrite the values in the conf directory or delete the existing dummy key and trust stores so they cannot interfere)

  1. Using keytool, create a certificate for the broker:

  2. Export the broker's certificate so it can be shared with clients:

  3. Create a certificate/keystore for the client:

  4. Create a truststore for the client, and import the broker's certificate. This establishes that the client "trusts" the broker:

Starting the Broker

Using the* System Properties

Before starting the broker's VM set the SSL_OPTS enviorment variable so that it knows to use the broker keystore.

Using Spring to configure SSL for a Broker instance

Sometimes the use of* system properties is not appropriate as they effect all SSL users in a JVM. ActiveMQ 5.2.x adds an <sslContext> element to the <amq:broker> that allows a broker specific set of SSL properties to be configured.

The SslContext test case validates starting an SSL transport listener using the configuration specified in the broker Xbean. The SslContext element is added to the broker as follows:

The SslContext is used to configure the SslTransportFactory for that broker. Full details of the configuration options available can be seen in the schema definition or in the accessors of org.apache.activemq.spring.SpringSslContext

Starting the Client

When starting the client's VM, specify the following system properties:


In Linux, do not use absolute path to keystore. By default, keytool uses ~/.keystore, but in some setups passing to Java VM does not work. This is not ActiveMQ specific but good to keep in mind anyway.

Client certificates

If you want to verify client certificates, you need to take a few extra steps:

  1. Export the client's certificate so it can be shared with broker:

  2. Create a truststore for the broker, and import the client's certificate. This establishes that the broker "trusts" the client:

  3. Add

    to SSL_OPTS

  4. Instruct ActiveMQ to require client authentication by setting the following in activemq.xml:

Certificate revocation

Starting with version 5.12, you can define certificate revocation list (CRL) path on ssl context, so that invalid certificates can revoked

This list is static and loaded on broker startup. You can also enable more advanced Online Certificate Status Protocol (OCSP) protocol by setting appropriate system properties (in ${ACTIVEMQ_HOME}/bin/env) like

These links might also help

© 2004-2011 The Apache Software Foundation.
Apache ActiveMQ, ActiveMQ, Apache, the Apache feather logo, and the Apache ActiveMQ project logo are trademarks of The Apache Software Foundation. All other marks mentioned may be trademarks or registered trademarks of their respective owners.
Graphic Design By Hiram