mq-jms-spring icon indicating copy to clipboard operation
mq-jms-spring copied to clipboard

The SSL configuration using ibm.mq.jks.* properties can happen too late if other SSL connections are set up early

Open fdlk opened this issue 1 year ago • 0 comments

In spring boot 2.x, when we use the ibm.mq.jks.* properties, I see them set the runtime properties. Unfortunately, in our setup, other autoconfiguration by then has already initiated the SSL context, to create a secure connection to a database. So the default values of the runtime properties have already been read and the updated values are never used. If I set the runtime properties by hand, the configuration works fine. This is hard to debug, though setting -Djavax.net.debug helps:

2023-10-09 13:48:16,485 DEBUG [restartedMain] sun.util.logging.internal.LoggingProviderImpl$JULWrapper: Reload the trust store
2023-10-09 13:48:16,513 DEBUG [restartedMain] sun.util.logging.internal.LoggingProviderImpl$JULWrapper: Reload trust certs
2023-10-09 13:48:16,514 DEBUG [restartedMain] sun.util.logging.internal.LoggingProviderImpl$JULWrapper: Reloaded 129 trust certs
2023-10-09 13:48:16,617 DEBUG [restartedMain] sun.util.logging.internal.LoggingProviderImpl$JULWrapper: adding as trusted certificates
2023-10-09 13:48:16,618 DEBUG [restartedMain] sun.util.logging.internal.LoggingProviderImpl$JULWrapper: keyStore is : 
2023-10-09 13:48:16,618 DEBUG [restartedMain] sun.util.logging.internal.LoggingProviderImpl$JULWrapper: keyStore type is : pkcs12
2023-10-09 13:48:16,618 DEBUG [restartedMain] sun.util.logging.internal.LoggingProviderImpl$JULWrapper: keyStore provider is : 
2023-10-09 13:48:16,620 DEBUG [restartedMain] sun.util.logging.internal.LoggingProviderImpl$JULWrapper: init keymanager of type SunX509
[...]
2023-10-09 13:48:23,546 TRACE [restartedMain] [com.ibm.mq](http://com.ibm.mq/).spring.boot.MQConfigurationProperties: JKS keystore           : config/keystore.p12
2023-10-09 13:48:23,546 TRACE [restartedMain] [com.ibm.mq](http://com.ibm.mq/).spring.boot.MQConfigurationProperties: JKS keystore pw set    : YES

fdlk avatar Oct 09 '23 12:10 fdlk