Introduction
In my previous blog, I demonstrated how to change mule application logging level dynamically by using JMX MBeans. In that blog, I skipped the procedure on how to enable SSL for JMX of Mule runtimes. Apparently, in production environment, we will need to enable both authentication and SSL for the security purpose.
I will demonstrate the details about enabling SSL for on-premises Mule Runtimes. I will use local generated Cert for demonstration purpose. You may need to authorized the cert for your organization, but the basic procedures are the same.
Generate Keystore and Truststore
On mule runtime server, execute the following commands:
mkdir ${MULE_HOME}/ssl cd ${MULE_HOME}/ssl keytool -genkey -alias tc401 -keyalg RSA -keystore tc401_keystore.jks keytool -export alias tc401 -file tc401_cert -keystore tc401_keystore.jks keytool -import -alias tc401 -keystore tc401_truststore.jks -file tc401_cert
The above commands will create keystore and truststore, which will be used by Mule Runtimes. To instruct a Mule Runtime to use the keystore and truststore, we need to update wrapper.conf file.
Configure Mule Runtime with Authentication and SSL
Add the following lines to ${MULE_HOME}/conf/wrapper.conf
wrapper.java.additional.50=-Dcom.sun.management.jmxremote=true wrapper.java.additional.51=-Dcom.sun.management.jmxremote.port=1099 wrapper.java.additional.53=-Dcom.sun.management.jmxremote.access.file=%MULE_HOME%/conf/jmxremote.access wrapper.java.additional.54=-Dcom.sun.management.jmxremote.password.file=%MULE_HOME%/conf/jmxremote.password wrapper.java.additional.56=-Dcom.sun.management.jmxremote.authenticate=true wrapper.java.additional.57=-Dcom.sun.management.jmxremote.ssl=true wrapper.java.additional.58=-Djavax.net.ssl.keyStore=%MULE_HOME%/ssl/tc401_keystore.jks wrapper.java.additional.59=-Djavax.net.ssl.keyStorePassword=changeme wrapper.java.additional.60=-Djavax.net.ssl.trustStore=%MULE_HOME%/ssl/tc401_keystore.jks wrapper.java.additional.61=-Djavax.net.ssl.trustStorePassword=changeme
Note that I use jmxremote.access and jmxremote.password for the user permission and authentication. The details can be refered in my last blog.
Start jvisualvm
jvisualvm -J-Djavax.net.ssl.trustStore=./tc401_truststore.jks -J-Djavax.net.ssl.trustStorePassword=changemeThe following snapshots shows how the page of login with SSL enabled.
Very informative post for mulesoft developers.You can also visit goformule.com for mulesoft stuff.
ReplyDelete