Spring Boot集成Apache Camel+IBM MQ的SSL配置求助

核心配置要点 #

要为IBM MQ的JMS连接工厂添加SSL认证，需完成以下关键配置：

• 指定与MQ服务器匹配的SSL密码套件
• 配置密钥库/信任库（用于证书身份验证）
• 设置SSL协议版本（推荐使用TLSv1.2及以上）

完整代码示例 #

补充SSL配置后的MQQueueConnectionFactory Bean实现：

import com.ibm.mq.jms.MQQueueConnectionFactory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import javax.net.ssl.SSLContext;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.TrustManagerFactory;
import java.io.FileInputStream;
import java.security.KeyStore;

@Configuration
public class MQConfig {
    private static final Logger LOG = LoggerFactory.getLogger(MQConfig.class);

    @Value("${mq.host}")
    private String host;
    @Value("${mq.channel}")
    private String channel;
    @Value("${mq.port}")
    private int port;
    @Value("${mq.queue-manager}")
    private String queueManager;
    @Value("${mq.ssl.cipher-suite}")
    private String sslCipherSuite;
    @Value("${mq.ssl.key-store-path}")
    private String keyStorePath;
    @Value("${mq.ssl.key-store-password}")
    private String keyStorePassword;
    @Value("${mq.ssl.trust-store-path}")
    private String trustStorePath;
    @Value("${mq.ssl.trust-store-password}")
    private String trustStorePassword;
    @Value("${mq.ssl.protocol:TLSv1.2}")
    private String sslProtocol;

    @Bean
    public MQQueueConnectionFactory mqQueueConnectionFactory() {
        MQQueueConnectionFactory mqQueueConnectionFactory = new MQQueueConnectionFactory();
        mqQueueConnectionFactory.setHostName(host);
        try {
            mqQueueConnectionFactory.setChannel(channel);
            mqQueueConnectionFactory.setPort(port);
            mqQueueConnectionFactory.setQueueManager(queueManager);

            // 配置SSL密码套件
            mqQueueConnectionFactory.setSSLCipherSuite(sslCipherSuite);

            // 构建自定义SSL上下文（密钥库+信任库）
            KeyStore keyStore = KeyStore.getInstance("JKS");
            keyStore.load(new FileInputStream(keyStorePath), keyStorePassword.toCharArray());

            KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            kmf.init(keyStore, keyStorePassword.toCharArray());

            KeyStore trustStore = KeyStore.getInstance("JKS");
            trustStore.load(new FileInputStream(trustStorePath), trustStorePassword.toCharArray());

            TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            tmf.init(trustStore);

            SSLContext sslContext = SSLContext.getInstance(sslProtocol);
            sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
            mqQueueConnectionFactory.setSSLContext(sslContext);

            // 设置SSL协议版本
            mqQueueConnectionFactory.setSSLProtocol(sslProtocol);

        } catch (Exception e) {
            LOG.error(e.getMessage(), e);
        }
        return mqQueueConnectionFactory;
    }

    // 整合到Apache Camel JMS组件
    @Bean
    public org.apache.camel.component.jms.JmsComponent jmsComponent(MQQueueConnectionFactory connectionFactory) {
        org.apache.camel.component.jms.JmsComponent jmsComponent = new org.apache.camel.component.jms.JmsComponent();
        jmsComponent.setConnectionFactory(connectionFactory);
        return jmsComponent;
    }
}

关键配置说明 #

• 密码套件匹配：SSLCipherSuite的值必须与IBM MQ服务器端配置完全一致，常见有效值包括TLS_RSA_WITH_AES_256_CBC_SHA256、TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384，具体以MQ服务器的SSL配置为准。
• 密钥库与信任库：
  • 密钥库存储客户端证书，用于双向认证场景下MQ服务器验证客户端身份。
  • 信任库存储MQ服务器的CA证书，用于客户端验证服务器身份；单向认证场景下仅需配置信任库。
• 简化配置方式：若无需自定义SSLContext，可直接通过系统属性设置密钥库/信任库：

  System.setProperty("javax.net.ssl.keyStore", keyStorePath);
  System.setProperty("javax.net.ssl.keyStorePassword", keyStorePassword);
  System.setProperty("javax.net.ssl.trustStore", trustStorePath);
  System.setProperty("javax.net.ssl.trustStorePassword", trustStorePassword);
  

• 端口注意：确保配置的端口是MQ服务器的SSL监听端口（默认非SSL端口为1414，SSL端口通常为1415，具体以实际部署为准）。

内容的提问来源于stack exchange，提问作者Beerus239