Community

Blog Events Webinars Tutorials Forum
  1. Blog
  2. Events
  3. Webinars
  4. Tutorials
  5. Forum
Create Account
×
Community Blog How to Configure TLS-encrypted Transmission in RocketMQ 5.0?

How to Configure TLS-encrypted Transmission in RocketMQ 5.0?

This tutorial describes how to configure TLS-encrypted transmission in RocketMQ 5.0.

By Wei Li, Apache RocketMQ Committer, RocketMQ Python Client Project Owner, Apache Doris Contributor, and TencentDB Development Engineer

1. Transmission Architecture

Namesrv: 5.1.0
Broker: 5.1.0
Dashboard: 1.0.1-SNAPSHOT

1

2. Prepare CA Certificates and Keys for the Namesrv, the Broker, and the Client

All the following operations are performed in the directory /etc/rocketmq, and Namesrv, Broker, and Dashboard are on the same machine. The Dashboard or the Client can also be on other machines.

1. Generate CA Certificates

Enter and confirm the password for the CA certificate. The characters you enter will not be visible.

openssl req -newkey rsa:2048 -keyout ca_rsa_private.pem -x509 -days 365 -out ca.pem

• Enter additional information. If you do not want to provide any, simply enter a period (.)

2
Generate CA certificates

2. Generate Public and Private Keys for Encrypted Client-server Communication

openssl req -newkey rsa:2048 -keyout server_rsa.key -out server.csr
Generating a 2048 bit RSA private key

3
Generate encryption key pairs

3. Generate Encryption Key Pairs and Issue Certificates for the Namesrv and the Broker

openssl req -newkey rsa:2048 -keyout server_rsa.key -out server.csrGenerating a 2048 bit RSA private key

4
Generate keys and issue certificates for the namesrv and the broker

4. Package and Encrypt Private Keys of the Namesrv and the Broker

5

5. Add TLS Configuration Files for the Namesrv and the Broker

• tls-broker.properties

tls.test.mode.enable=false
tls.server.need.client.auth=none
tls.server.keyPath=/etc/rocketmq/server.key
tls.server.keyPassword=123456
tls.server.certPath=/etc/rocketmq/server.pem
tls.client.authServer=false
tls.client.trustCertPath=/etc/rocketmq/ca.pem

• tls-namesrv.properties

tls.test.mode.enable=false
tls.server.need.client.auth=none
tls.server.keyPath=/etc/rocketmq/server.key
tls.server.keyPassword=123456
tls.server.certPath=/etc/rocketmq/server.pem

• tls-client.properties

tls.client.trustCertPath=/etc/rocketmq/ca.pem

Then, you have all the tls configuration files:

6
All configuration files

3. Modify Startup Scripts

3.1 Modify the Namesrv Startup Script

vim bin/runserver.sh

7
Modify the namesrv startup script

3.2 Modify the Broker Startup Configuration

• Modify the broker startup script and configure the jvm to support tls

vim bin/runbroker.sh

8
Modify the broker startup script

• Add broker.conf

brokerClusterName = DefaultCluster
brokerName = broker-a
brokerId = 0
deleteWhen = 04
fileReservedTime = 48
brokerRole = ASYNC_MASTER
flushDiskType = ASYNC_FLUSH
namesrvAddr = 127.0.0.1:9876

3.3 Modify the Dashboard Configuration

• Modify the namesrv address

9
Modify the namesrv address

• Enable tls

vim rocketmq-dashboard-1.0.1-SNAPSHOT.jar

10
Modify the dashboard configuration

Note: For producer and consumer clients, configure the following parameters:

11
Enable tls on the consumer client

12
Enable tls on the producer client

4. Start the Namesrv, the Broker, and the Dashboard

• Start the namesrv

nohup sh bin/mqnamesrv &

• Start the broker

nohup sh bin/mqbroker -c conf/broker.conf &

• Start the dashboard

java -Dtls.client.authServer=true -Dtls.enable=true -Dtls.test.mode.enable=false -Dtls.config.file=/etc/rocketmq/tls-client.properties -jar rocketmq-dashboard-1.0.1-SNAPSHOT.jar

5. Check

• Check and analyze the captured packet by using the tcpdump

13
Packet capture result by using TLS

• Check the logs of the rocketmq dashboad:

~/logs/rocketmqlogs/rocketmq_client.log

14

6. Question: Why is TCP Still Present in the Packet Capture Result?

• Why is TCP still present in the packet capture result?

15

• You can enable tls on the client by setting the -Dtls.enable value to true. However, you still need to set the code "producer.setUseTLS(useTls);" or "consumer.setUseTLS(useTls);". Why?

7. What Is the Final File?

• ca.pemca, root certificate

16

• ca_rsa_private.pemca, the encrypted private key of the root certificate

17

• server.pem, the certificate for the namesrv and the broker that is issued by using the root certificate

18

• server_rsa.key, the encrypted private key of the namesrv and the broker

19

• server.csr, the public key of the encryption certificates of the namesrv and the broker, and name to identify the certificate migration authority

20

• server.key, the packaged and encrypted private key of the namesrv and the broker (server_rsa.key)

21

• ca.srlca, the serial number of the issued certificates

22

1. tls-namesrv.properties

Configuration for TLS encryption transmission identified by Netty in the Namesrv. For more details, refer to the previous section.

2. tls-broker.properties

Configuration for TLS encryption transmission identified by Netty in the Broker. For more details, refer to the previous section.

3. tls-client.properties

Configuration for TLS encryption transmission identified by Netty in the Client. For more details, refer to the previous section.

Note: The TLS configuration in RocketMQ Version 4.X is similar to that of Version 5.X. Both versions support TLS encryption.

middleware RocketMQ Computing Developers Tutorials Message Queue cloud native TLS Apache RocketMQ Transport Layer Security
0 1 0
Share on

Read previous post:

RocketMQ 5.0 VS 4.9.X: Comparison of Architecture Diagram

Read next post:

A Reinterpretation of RocketMQ Commit Log Storage Protocol

Alibaba Cloud Native Community

482 posts | 48 followers

You may also like

Comments

Alibaba Cloud Native Community

482 posts | 48 followers

Related Products

  • ApsaraMQ for RocketMQ

    ApsaraMQ for RocketMQ is a distributed message queue service that supports reliable message-based asynchronous communication among microservices, distributed systems, and serverless applications.

    Learn More

  • Function Compute

    Alibaba Cloud Function Compute is a fully-managed event-driven compute service. It allows you to focus on writing and uploading code without the need to manage infrastructure such as servers.

    Learn More

  • Elastic High Performance Computing Solution

    High Performance Computing (HPC) and AI technology helps scientific research institutions to perform viral gene sequencing, conduct new drug research and development, and shorten the research and development cycle.

    Learn More

  • Quick Starts

    Deploy custom Alibaba Cloud solutions for business-critical scenarios with Quick Start templates.

    Learn More

More Posts by Alibaba Cloud Native Community

See All