Simon Lundstrom created AMQ-6837: ------------------------------------ Summary: Intermediate CA certificate required in trustStore Key: AMQ-6837 URL: https://issues.apache.org/jira/browse/AMQ-6837 Project: ActiveMQ Issue Type: Bug Components: JDBC Affects Versions: 5.15.1 Environment: {code} # lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 14.04.5 LTS Release: 14.04 Codename: trusty # java -version java version "1.8.0_112" Java(TM) SE Runtime Environment (build 1.8.0_112-b15) Java HotSpot(TM) 64-Bit Server VM (build 25.112-b15, mixed mode) {code} Reporter: Simon Lundstrom
When configuring ActiveMQ to use JDBC and MySQL with SSL the trustStore configured must have the intermediate CA certificate in the keystore. Our certificate uses an intermediate CA, so the cerificate looks like this: mysql.server -> Intermediate CA -> Root CA. When using JDBC and/or DBCP directly, like in our example code below, you can connect to MySQL by using only the Root CA in your trustStore. ActiveMQ requires both the Root CA *and* the Intermediate CA. Example code: {code} import java.io.IOException; import java.sql.Connection; import java.sql.DriverManager; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import org.apache.commons.dbcp2.BasicDataSource; import javax.sql.DataSource; public class Launcher { public static void main(String[] args) throws SQLException, ClassNotFoundException { StringBuffer sb = new StringBuffer("jdbc:mysql://hostname/database?useSSL=true&"); sb.append("useJDBCCompliantTimezoneShift=true&requireSSL=true&verifyServerCertificate=true&connectTimeout=5000&socketTimeout=5000&queryTimeoutKillsConnection=true&"); sb.append("poolPreparedStatements=true&validationQuery=select 1&"); // sb.append("trustCertificateKeyStorePassword=changeit&"); // sb.append("trustCertificateKeyStoreUrl=file:///etc/ssl/certs/java/cacerts&"); sb.append("user=user&password=password"); DataSource dataSource = setupDataSource(sb.toString()); Connection c = dataSource.getConnection(); Statement st = c.createStatement(); ResultSet rs = st.executeQuery("SELECT 1 as id"); while (rs.next()) { System.out.println(rs.getInt("id")); } rs.close(); st.close(); c.close(); } public static DataSource setupDataSource(String connectURI) { BasicDataSource ds = new BasicDataSource(); ds.setDriverClassName("com.mysql.jdbc.Driver"); ds.setUrl(connectURI); return ds; } } {code} Stacktrace, in JSON, from ActiveMQ: {code} { "endOfBatch": false, "level": "WARN", "loggerFqcn": "org.slf4j.impl.Log4jLoggerAdapter", "loggerName": "org.apache.activemq.store.jdbc.JDBCPersistenceAdapter", "message": "Could not get JDBC connection: Cannot create PoolableConnectionFactory (Communications link failure\n\nThe last packet successfully received from the server was 760 milliseconds ago. The last packet sent successfully to the server was 755 milliseconds ago.)", "thread": "main", "thrown": { "cause": { "cause": { "commonElementCount": 23, "extendedStackTrace": [ { "class": "sun.security.ssl.Alerts", "exact": false, "file": "Alerts.java", "line": 192, "location": "?", "method": "getSSLException", "version": "1.8.0_112" }, { "class": "sun.security.ssl.Alerts", "exact": false, "file": "Alerts.java", "line": 154, "location": "?", "method": "getSSLException", "version": "1.8.0_112" }, { "class": "sun.security.ssl.SSLSocketImpl", "exact": false, "file": "SSLSocketImpl.java", "line": 2023, "location": "?", "method": "recvAlert", "version": "1.8.0_112" }, { "class": "sun.security.ssl.SSLSocketImpl", "exact": false, "file": "SSLSocketImpl.java", "line": 1125, "location": "?", "method": "readRecord", "version": "1.8.0_112" }, { "class": "sun.security.ssl.SSLSocketImpl", "exact": false, "file": "SSLSocketImpl.java", "line": 1769, "location": "?", "method": "waitForClose", "version": "1.8.0_112" }, { "class": "sun.security.ssl.HandshakeOutStream", "exact": false, "file": "HandshakeOutStream.java", "line": 124, "location": "?", "method": "flush", "version": "1.8.0_112" }, { "class": "sun.security.ssl.Handshaker", "exact": false, "file": "Handshaker.java", "line": 1083, "location": "?", "method": "sendChangeCipherSpec", "version": "1.8.0_112" }, { "class": "sun.security.ssl.ClientHandshaker", "exact": false, "file": "ClientHandshaker.java", "line": 1222, "location": "?", "method": "sendChangeCipherAndFinish", "version": "1.8.0_112" }, { "class": "sun.security.ssl.ClientHandshaker", "exact": false, "file": "ClientHandshaker.java", "line": 1134, "location": "?", "method": "serverHelloDone", "version": "1.8.0_112" }, { "class": "sun.security.ssl.ClientHandshaker", "exact": false, "file": "ClientHandshaker.java", "line": 348, "location": "?", "method": "processMessage", "version": "1.8.0_112" }, { "class": "sun.security.ssl.Handshaker", "exact": false, "file": "Handshaker.java", "line": 979, "location": "?", "method": "processLoop", "version": "1.8.0_112" }, { "class": "sun.security.ssl.Handshaker", "exact": false, "file": "Handshaker.java", "line": 914, "location": "?", "method": "process_record", "version": "1.8.0_112" }, { "class": "sun.security.ssl.SSLSocketImpl", "exact": false, "file": "SSLSocketImpl.java", "line": 1062, "location": "?", "method": "readRecord", "version": "1.8.0_112" }, { "class": "sun.security.ssl.SSLSocketImpl", "exact": false, "file": "SSLSocketImpl.java", "line": 1375, "location": "?", "method": "performInitialHandshake", "version": "1.8.0_112" }, { "class": "sun.security.ssl.SSLSocketImpl", "exact": false, "file": "SSLSocketImpl.java", "line": 1403, "location": "?", "method": "startHandshake", "version": "1.8.0_112" }, { "class": "sun.security.ssl.SSLSocketImpl", "exact": false, "file": "SSLSocketImpl.java", "line": 1387, "location": "?", "method": "startHandshake", "version": "1.8.0_112" }, { "class": "com.mysql.jdbc.ExportControlled", "exact": false, "file": "ExportControlled.java", "line": 95, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "transformSocketToSSLSocket", "version": "5.1.37" }, { "class": "com.mysql.jdbc.MysqlIO", "exact": false, "file": "MysqlIO.java", "line": 4793, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "negotiateSSLConnection", "version": "5.1.37" }, { "class": "com.mysql.jdbc.MysqlIO", "exact": false, "file": "MysqlIO.java", "line": 1635, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "proceedHandshakeWithPluggableAuthentication", "version": "5.1.37" }, { "class": "com.mysql.jdbc.MysqlIO", "exact": false, "file": "MysqlIO.java", "line": 1207, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "doHandshake", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ConnectionImpl", "exact": false, "file": "ConnectionImpl.java", "line": 2254, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "coreConnect", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ConnectionImpl", "exact": false, "file": "ConnectionImpl.java", "line": 2285, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "connectOneTryOnly", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ConnectionImpl", "exact": false, "file": "ConnectionImpl.java", "line": 2084, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "createNewIO", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ConnectionImpl", "exact": false, "file": "ConnectionImpl.java", "line": 795, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "<init>", "version": "5.1.37" }, { "class": "com.mysql.jdbc.JDBC4Connection", "exact": false, "file": "JDBC4Connection.java", "line": 44, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "<init>", "version": "5.1.37" }, { "class": "sun.reflect.NativeConstructorAccessorImpl", "exact": false, "file": "NativeConstructorAccessorImpl.java", "line": -2, "location": "?", "method": "newInstance0", "version": "1.8.0_112" }, { "class": "sun.reflect.NativeConstructorAccessorImpl", "exact": false, "file": "NativeConstructorAccessorImpl.java", "line": 62, "location": "?", "method": "newInstance", "version": "1.8.0_112" }, { "class": "sun.reflect.DelegatingConstructorAccessorImpl", "exact": false, "file": "DelegatingConstructorAccessorImpl.java", "line": 45, "location": "?", "method": "newInstance", "version": "1.8.0_112" }, { "class": "java.lang.reflect.Constructor", "exact": false, "file": "Constructor.java", "line": 423, "location": "?", "method": "newInstance", "version": "1.8.0_112" }, { "class": "com.mysql.jdbc.Util", "exact": false, "file": "Util.java", "line": 404, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "handleNewInstance", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ConnectionImpl", "exact": false, "file": "ConnectionImpl.java", "line": 400, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "getInstance", "version": "5.1.37" }, { "class": "com.mysql.jdbc.NonRegisteringDriver", "exact": false, "file": "NonRegisteringDriver.java", "line": 327, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "connect", "version": "5.1.37" }, { "class": "org.apache.commons.dbcp2.DriverConnectionFactory", "exact": false, "file": "DriverConnectionFactory.java", "line": 39, "location": "commons-dbcp2-2.1.1.jar", "method": "createConnection", "version": "2.1.1" }, { "class": "org.apache.commons.dbcp2.PoolableConnectionFactory", "exact": false, "file": "PoolableConnectionFactory.java", "line": 256, "location": "commons-dbcp2-2.1.1.jar", "method": "makeObject", "version": "2.1.1" }, { "class": "org.apache.commons.dbcp2.BasicDataSource", "exact": false, "file": "BasicDataSource.java", "line": 2304, "location": "commons-dbcp2-2.1.1.jar", "method": "validateConnectionFactory", "version": "2.1.1" }, { "class": "org.apache.commons.dbcp2.BasicDataSource", "exact": false, "file": "BasicDataSource.java", "line": 2290, "location": "commons-dbcp2-2.1.1.jar", "method": "createPoolableConnectionFactory", "version": "2.1.1" } ], "localizedMessage": "Received fatal alert: unknown_ca", "message": "Received fatal alert: unknown_ca", "name": "javax.net.ssl.SSLHandshakeException" }, "commonElementCount": 23, "extendedStackTrace": [ { "class": "sun.reflect.NativeConstructorAccessorImpl", "exact": false, "file": "NativeConstructorAccessorImpl.java", "line": -2, "location": "?", "method": "newInstance0", "version": "1.8.0_112" }, { "class": "sun.reflect.NativeConstructorAccessorImpl", "exact": false, "file": "NativeConstructorAccessorImpl.java", "line": 62, "location": "?", "method": "newInstance", "version": "1.8.0_112" }, { "class": "sun.reflect.DelegatingConstructorAccessorImpl", "exact": false, "file": "DelegatingConstructorAccessorImpl.java", "line": 45, "location": "?", "method": "newInstance", "version": "1.8.0_112" }, { "class": "java.lang.reflect.Constructor", "exact": false, "file": "Constructor.java", "line": 423, "location": "?", "method": "newInstance", "version": "1.8.0_112" }, { "class": "com.mysql.jdbc.Util", "exact": false, "file": "Util.java", "line": 404, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "handleNewInstance", "version": "5.1.37" }, { "class": "com.mysql.jdbc.SQLError", "exact": false, "file": "SQLError.java", "line": 983, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "createCommunicationsException", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ExportControlled", "exact": false, "file": "ExportControlled.java", "line": 110, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "transformSocketToSSLSocket", "version": "5.1.37" }, { "class": "com.mysql.jdbc.MysqlIO", "exact": false, "file": "MysqlIO.java", "line": 4793, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "negotiateSSLConnection", "version": "5.1.37" }, { "class": "com.mysql.jdbc.MysqlIO", "exact": false, "file": "MysqlIO.java", "line": 1635, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "proceedHandshakeWithPluggableAuthentication", "version": "5.1.37" }, { "class": "com.mysql.jdbc.MysqlIO", "exact": false, "file": "MysqlIO.java", "line": 1207, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "doHandshake", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ConnectionImpl", "exact": false, "file": "ConnectionImpl.java", "line": 2254, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "coreConnect", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ConnectionImpl", "exact": false, "file": "ConnectionImpl.java", "line": 2285, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "connectOneTryOnly", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ConnectionImpl", "exact": false, "file": "ConnectionImpl.java", "line": 2084, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "createNewIO", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ConnectionImpl", "exact": false, "file": "ConnectionImpl.java", "line": 795, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "<init>", "version": "5.1.37" }, { "class": "com.mysql.jdbc.JDBC4Connection", "exact": false, "file": "JDBC4Connection.java", "line": 44, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "<init>", "version": "5.1.37" }, { "class": "sun.reflect.NativeConstructorAccessorImpl", "exact": false, "file": "NativeConstructorAccessorImpl.java", "line": -2, "location": "?", "method": "newInstance0", "version": "1.8.0_112" }, { "class": "sun.reflect.NativeConstructorAccessorImpl", "exact": false, "file": "NativeConstructorAccessorImpl.java", "line": 62, "location": "?", "method": "newInstance", "version": "1.8.0_112" }, { "class": "sun.reflect.DelegatingConstructorAccessorImpl", "exact": false, "file": "DelegatingConstructorAccessorImpl.java", "line": 45, "location": "?", "method": "newInstance", "version": "1.8.0_112" }, { "class": "java.lang.reflect.Constructor", "exact": false, "file": "Constructor.java", "line": 423, "location": "?", "method": "newInstance", "version": "1.8.0_112" }, { "class": "com.mysql.jdbc.Util", "exact": false, "file": "Util.java", "line": 404, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "handleNewInstance", "version": "5.1.37" }, { "class": "com.mysql.jdbc.ConnectionImpl", "exact": false, "file": "ConnectionImpl.java", "line": 400, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "getInstance", "version": "5.1.37" }, { "class": "com.mysql.jdbc.NonRegisteringDriver", "exact": false, "file": "NonRegisteringDriver.java", "line": 327, "location": "mysql-connector-java-5.1.37-bin.jar", "method": "connect", "version": "5.1.37" }, { "class": "org.apache.commons.dbcp2.DriverConnectionFactory", "exact": false, "file": "DriverConnectionFactory.java", "line": 39, "location": "commons-dbcp2-2.1.1.jar", "method": "createConnection", "version": "2.1.1" }, { "class": "org.apache.commons.dbcp2.PoolableConnectionFactory", "exact": false, "file": "PoolableConnectionFactory.java", "line": 256, "location": "commons-dbcp2-2.1.1.jar", "method": "makeObject", "version": "2.1.1" }, { "class": "org.apache.commons.dbcp2.BasicDataSource", "exact": false, "file": "BasicDataSource.java", "line": 2304, "location": "commons-dbcp2-2.1.1.jar", "method": "validateConnectionFactory", "version": "2.1.1" }, { "class": "org.apache.commons.dbcp2.BasicDataSource", "exact": false, "file": "BasicDataSource.java", "line": 2290, "location": "commons-dbcp2-2.1.1.jar", "method": "createPoolableConnectionFactory", "version": "2.1.1" } ], "localizedMessage": "Communications link failure\n\nThe last packet successfully received from the server was 760 milliseconds ago. The last packet sent successfully to the server was 755 milliseconds ago.", "message": "Communications link failure\n\nThe last packet successfully received from the server was 760 milliseconds ago. The last packet sent successfully to the server was 755 milliseconds ago.", "name": "com.mysql.jdbc.exceptions.jdbc4.CommunicationsException" }, "commonElementCount": 0, "extendedStackTrace": [ { "class": "org.apache.commons.dbcp2.BasicDataSource", "exact": false, "file": "BasicDataSource.java", "line": 2294, "location": "commons-dbcp2-2.1.1.jar", "method": "createPoolableConnectionFactory", "version": "2.1.1" }, { "class": "org.apache.commons.dbcp2.BasicDataSource", "exact": false, "file": "BasicDataSource.java", "line": 2039, "location": "commons-dbcp2-2.1.1.jar", "method": "createDataSource", "version": "2.1.1" }, { "class": "org.apache.commons.dbcp2.BasicDataSource", "exact": false, "file": "BasicDataSource.java", "line": 1533, "location": "commons-dbcp2-2.1.1.jar", "method": "getConnection", "version": "2.1.1" }, { "class": "org.apache.activemq.store.jdbc.TransactionContext", "exact": true, "file": "TransactionContext.java", "line": 59, "location": "activemq-jdbc-store-5.13.4.jar", "method": "getConnection", "version": "5.13.4" }, { "class": "org.apache.activemq.store.jdbc.JDBCPersistenceAdapter", "exact": true, "file": "JDBCPersistenceAdapter.java", "line": 449, "location": "activemq-jdbc-store-5.13.4.jar", "method": "loadAdapter", "version": "5.13.4" }, { "class": "org.apache.activemq.store.jdbc.JDBCPersistenceAdapter", "exact": true, "file": "JDBCPersistenceAdapter.java", "line": 432, "location": "activemq-jdbc-store-5.13.4.jar", "method": "createAdapter", "version": "5.13.4" }, { "class": "org.apache.activemq.store.jdbc.JDBCPersistenceAdapter", "exact": true, "file": "JDBCPersistenceAdapter.java", "line": 381, "location": "activemq-jdbc-store-5.13.4.jar", "method": "getAdapter", "version": "5.13.4" }, { "class": "org.apache.activemq.store.jdbc.JDBCPersistenceAdapter", "exact": true, "file": "JDBCPersistenceAdapter.java", "line": 296, "location": "activemq-jdbc-store-5.13.4.jar", "method": "init", "version": "5.13.4" }, { "class": "org.apache.activemq.broker.LockableServiceSupport", "exact": true, "file": "LockableServiceSupport.java", "line": 89, "location": "activemq-broker-5.13.4.jar", "method": "preStart", "version": "5.13.4" }, { "class": "org.apache.activemq.util.ServiceSupport", "exact": true, "file": "ServiceSupport.java", "line": 54, "location": "activemq-client-5.13.4.jar", "method": "start", "version": "5.13.4" }, { "class": "org.apache.activemq.broker.BrokerService", "exact": true, "file": "BrokerService.java", "line": 672, "location": "activemq-broker-5.13.4.jar", "method": "doStartPersistenceAdapter", "version": "5.13.4" }, { "class": "org.apache.activemq.broker.BrokerService", "exact": true, "file": "BrokerService.java", "line": 656, "location": "activemq-broker-5.13.4.jar", "method": "startPersistenceAdapter", "version": "5.13.4" }, { "class": "org.apache.activemq.broker.BrokerService", "exact": true, "file": "BrokerService.java", "line": 620, "location": "activemq-broker-5.13.4.jar", "method": "start", "version": "5.13.4" }, { "class": "org.apache.activemq.console.command.StartCommand", "exact": true, "file": "StartCommand.java", "line": 88, "location": "activemq-console-5.13.4.jar", "method": "runTask", "version": "5.13.4" }, { "class": "org.apache.activemq.console.command.AbstractCommand", "exact": true, "file": "AbstractCommand.java", "line": 63, "location": "activemq-console-5.13.4.jar", "method": "execute", "version": "5.13.4" }, { "class": "org.apache.activemq.console.command.ShellCommand", "exact": true, "file": "ShellCommand.java", "line": 154, "location": "activemq-console-5.13.4.jar", "method": "runTask", "version": "5.13.4" }, { "class": "org.apache.activemq.console.command.AbstractCommand", "exact": true, "file": "AbstractCommand.java", "line": 63, "location": "activemq-console-5.13.4.jar", "method": "execute", "version": "5.13.4" }, { "class": "org.apache.activemq.console.command.ShellCommand", "exact": true, "file": "ShellCommand.java", "line": 104, "location": "activemq-console-5.13.4.jar", "method": "main", "version": "5.13.4" }, { "class": "sun.reflect.NativeMethodAccessorImpl", "exact": false, "file": "NativeMethodAccessorImpl.java", "line": -2, "location": "?", "method": "invoke0", "version": "1.8.0_112" }, { "class": "sun.reflect.NativeMethodAccessorImpl", "exact": false, "file": "NativeMethodAccessorImpl.java", "line": 62, "location": "?", "method": "invoke", "version": "1.8.0_112" }, { "class": "sun.reflect.DelegatingMethodAccessorImpl", "exact": false, "file": "DelegatingMethodAccessorImpl.java", "line": 43, "location": "?", "method": "invoke", "version": "1.8.0_112" }, { "class": "java.lang.reflect.Method", "exact": false, "file": "Method.java", "line": 498, "location": "?", "method": "invoke", "version": "1.8.0_112" }, { "class": "org.apache.activemq.console.Main", "exact": true, "file": "Main.java", "line": 262, "location": "activemq.jar", "method": "runTaskClass", "version": "5.13.4" }, { "class": "org.apache.activemq.console.Main", "exact": true, "file": "Main.java", "line": 115, "location": "activemq.jar", "method": "main", "version": "5.13.4" } ], "localizedMessage": "Cannot create PoolableConnectionFactory (Communications link failure\n\nThe last packet successfully received from the server was 760 milliseconds ago. The last packet sent successfully to the server was 755 milliseconds ago.)", "message": "Cannot create PoolableConnectionFactory (Communications link failure\n\nThe last packet successfully received from the server was 760 milliseconds ago. The last packet sent successfully to the server was 755 milliseconds ago.)", "name": "java.sql.SQLException" }, "timeMillis": 1507702258729 } {code} -- This message was sent by Atlassian JIRA (v6.4.14#64029)