Problem using SSL with JMX

Question

Hi ,
I am trying to implement SSL with JMX. I took the example of Luis Miguel Alventosa to see how it works. I imported all the classes, password a access properties file. When I am able to start the MyApp server in the example. But when I am trying to run MyClient, it is giving me the following exception
Initialize the environment map
Create an RMI connector client and connect it to the RMI connector server
Exception in thread "main" java.rmi.ConnectIOException: Exception creating connection to: <IP>; nested exception is:
     java.net.SocketException: Default SSL context init failed: null
     at sun.rmi.transport.tcp.TCPEndpoint.newSocket(Unknown Source)
     at sun.rmi.transport.tcp.TCPChannel.createConnection(Unknown Source)
     at sun.rmi.transport.tcp.TCPChannel.newConnection(Unknown Source)
     at sun.rmi.server.UnicastRef.newCall(Unknown Source)
     at sun.rmi.registry.RegistryImpl_Stub.lookup(Unknown Source)
     at com.example.MyClient.main(MyClient.java:30)
Caused by: java.net.SocketException: Default SSL context init failed: null
     at javax.net.ssl.DefaultSSLSocketFactory.createSocket(Unknown Source)
     at javax.rmi.ssl.SslRMIClientSocketFactory.createSocket(Unknown Source)
     ... 6 moreHere is the MyApp code I used
package com.example;
import java.lang.management.*;
import java.rmi.registry.*;
import java.util.*;
import javax.management.*;
import javax.management.remote.*;
import javax.management.remote.rmi.*;
import javax.rmi.ssl.*;
public class MyApp {
    public static void main(String[] args) throws Exception {
        // Ensure cryptographically strong random number generator used
        // to choose the object number - see java.rmi.server.ObjID
        System.setProperty("java.rmi.server.randomIDs", "true");
        // Start a secure RMI registry on port 3000.
        System.out.println("Create a secure RMI registry on port 3000");
        SslRMIClientSocketFactory csf = new SslRMIClientSocketFactory();
        SslRMIServerSocketFactory ssf = new SslRMIServerSocketFactory(null, null, true);
        Registry registry = LocateRegistry.createRegistry(3000, csf, ssf);
        // Retrieve the PlatformMBeanServer.
        System.out.println("Get the platform's MBean server");
        MBeanServer mbs = ManagementFactory.getPlatformMBeanServer();
        // Environment map.
        System.out.println("Initialize the environment map");
        Map<String,Object> env = new HashMap<String,Object>();
        // Provide the password file used by the connector server to
        // perform user authentication. The password file is a properties
        // based text file specifying username/password pairs.
        env.put("jmx.remote.x.password.file", "password.properties");
        // Provide the access level file used by the connector server to
        // perform user authorization. The access level file is a properties
        // based text file specifying username/access level pairs where
        // access level is either "readonly" or "readwrite" access to the
        // MBeanServer operations.
        env.put("jmx.remote.x.access.file", "access.properties");
        // Create and start an RMI connector server.
        // As specified in the JMXServiceURL the RMIServer stub will be
        // registered in the RMI registry running in the local host on
        // port 3000 with the name "jmxrmi". This is the same name the
        // out-of-the-box management agent uses to register the RMIServer
        // stub too.
        // JMXServiceURL = "service:jmx:rmi:///jndi/rmi://:3000/jmxrmi"
        System.out.println("Create and start an RMI connector server");
        JMXServiceURL url = new JMXServiceURL("service:jmx:rmi://");
        RMIJRMPServerImpl server = new RMIJRMPServerImpl(3000, csf, ssf, env);
        RMIConnectorServer cs = new RMIConnectorServer(url, env, server, mbs);
        cs.start();
        registry.bind("jmxrmi", server);
        System.out.println("Waiting for incoming connections...");
}Here is the MyClient
package com.example;
import java.rmi.registry.*;
import java.util.*;
import javax.management.*;
import javax.management.remote.rmi.*;
import javax.rmi.ssl.SslRMIClientSocketFactory;
public class MyClient {
    public static void main(String[] args) throws Exception {
        // Environment map
        System.out.println("\nInitialize the environment map");
        Map<String,Object> env = new HashMap<String,Object>();
        // Provide the credentials required by the server to successfully
        // perform user authentication
        String[] credentials = new String[] { "username" , "password" };
        env.put("jmx.remote.credentials", credentials);
        // Create an RMI connector client and
        // connect it to the RMI connector server
        System.out.println("\nCreate an RMI connector client and " +
                "connect it to the RMI connector server");
        SslRMIClientSocketFactory csf = new SslRMIClientSocketFactory();
        Registry registry = LocateRegistry.getRegistry(null, 3000, csf);
        RMIServer stub = (RMIServer) registry.lookup("jmxrmi");
        RMIConnector jmxc = new RMIConnector(stub, env);
        jmxc.connect(env);
        // Get an MBeanServerConnection
        System.out.println("\nGet an MBeanServerConnection");
        MBeanServerConnection mbsc = jmxc.getMBeanServerConnection();
        // Get domains from MBeanServer
        System.out.println("\nDomains:");
        String domains[] = mbsc.getDomains();
        for (int i = 0; i < domains.length; i++) {
            System.out.println("\tDomain[" + i + "] = " + domains);
// Get MBean count
System.out.println("\nMBean count = " + mbsc.getMBeanCount());
// Close MBeanServer connection
System.out.println("\nClose the connection to the server");
jmxc.close();
System.out.println("\nBye! Bye!");
Here is the password.properties
monitorRole mrpasswd
controlRole crpasswdand access.properties
monitorRole readonly
controlRole readwriteI used the following jvm parameters to run the apps
-Djavax.net.ssl.keyStore=.keystore -Djavax.net.ssl.keyStorePassword=keypass -Djavax.net.ssl.trustStore=proxytruststore -Djavax.net.ssl.trustStorePassword=trustpassI really don't know where I am doing the mistake. Can anyone please give any idea ? For security I didnt disclosed the IP of my mechine in the error, insted I replace it with <IP>

Answer 1

Hi,
I assume you did create a keystore and trustore, right?
Could you verify that the paths to these files you give in your java options
are correct?
You could also try to activate debug traces - in particular security traces - see
at the end of this blog:
http://blogs.sun.com/jmxetc/entry/troubleshooting_connection_problems_in_jconsole
This may help you diagnose what is going wrong.
Hope this helps,
-- daniel
JMX, SNMP, Java, etc...
http://blogs.sun.com/jmxetc