Client certificate authentication not working - Unable to authenticate transport without SSL certificate.

[Chinchila01]

Hello,
I'm using ActiveMQ as a broker and trying to connect a rhea client to it. The configuration I'm using on the broker is the following:

activemq.xml:

<plugins>
            <jaasCertificateAuthenticationPlugin configuration="CertLogin" />
        </plugins>

login.config:

CertLogin {
    org.apache.activemq.security.JaasCertificateSecurityContext required
    	debug=true
};

However, when I try to connect, I get the following error:

connected successfully

events.js:167
      throw er; // Unhandled 'error' event
      ^
ConnectionError: Unable to authenticate transport without SSL certificate.

It seems the client is not correctly dealing with the client certificate authentication.

The rhea configuration I'm using is the following:

{
    transport: 'tls',
    hostname: 'amqps://localhost:5672',
    key: fs.readFileSync(path.resolve(__dirname, 'certificates/client.key.pem')),
    cert: fs.readFileSync(path.resolve(__dirname, 'certificates/client.cert.pem')),

    // This is necessary only if the server uses the self-signed certificate
    ca: [fs.readFileSync(path.resolve(__dirname, 'certificates/ca-chain.cert.pem'))],
}

Both broker and client certificates are from the same ca-chain and the broker's trust store includes the client certificate.
I have tried putting requestCert option to true, but the result is the same.
Any clues on how I can solve this? Is it a configuration error?
Thanks!

[grs]

Client certificate authentication is used successfully elsewhere.

The error comes from the ActiveMQ server. It sounds like it thinks there is no certificate presented by the client, so maybe check that the config you are using is what you think it is (if you have wireshark you could examine the start of the handshake, or else see if the error is the same whether you provide a key/cert on client or not). It could also be a trust issue (with a poor error message); usually the ca that signed the client cert is added to the trust store rather than each client cert itself.

[Chinchila01]

Hey,
I added both the client and the ca-chain to the truststore, so I don't think that's the issue. Before I did it correctly, the connection wouldn't even be completed as the certificate was rejected for being self signed.

I investigated more and it seems the activemq transport is not setting the TransportContext correctly, so it is null and, therefore, authentication is not possible.

I agree that it doesn't seem to be a Rhea issue.
Thanks!