title: Can't connect to broker over SSL
body: <p>I have an ActiveMQ instance running on localhost that's trying to connect to another instance running on AWS (Amazon MQ). The broker running on AWS requires the broker-to-broker connection to be made over SSL.</p>
  <p>In my localhost broker's <code>activemq.xml</code>, I added the following to create a connection with the broker running on AWS (just one way for now):</p>
  <pre><code>&lt;networkConnectors&gt;
      &lt;networkConnector name=&quot;local-to-aws&quot; userName=&quot;myCommonUser&quot; duplex=&quot;true&quot; uri=&quot;static:(ssl://###.mq.ca-central-1.amazonaws.com:61617)&quot;/&gt;
  &lt;/networkConnectors&gt;
  </code></pre>
  <p>If I try starting my localhost broker with that, I get the following error in my <code>activemy.log</code> file:</p>
  <pre><code>2021-01-29 20:19:32,638 | WARN  | Could not start network bridge between: vm://localhost and:
      ssl://###.mq.ca-central-1.amazonaws.com:61617 due to: java.security.NoSuchAlgorithmException: 
      Error constructing implementation (algorithm: Default, provider: SunJSSE, class: 
      sun.security.ssl.SSLContextImpl$DefaultSSLContext) | 
      org.apache.activemq.network.DiscoveryNetworkConnector | Simple Discovery Agent-2
  </code></pre>
  <p>So to try and fix that, I added the following in the localhost broker's <code>activemq.xml</code> config:</p>
  <pre><code>&lt;sslContext&gt;
      &lt;sslContext keyStore=&quot;file:${activemq.base}/conf/broker.ks&quot;
                  keyStorePassword=&quot;###&quot;
                  trustStore=&quot;file:${activemq.base}/conf/client.ts&quot;
                  trustStorePassword=&quot;###&quot;/&gt;
  &lt;/sslContext&gt;
  </code></pre>
  <p>The <code>broker.ks</code> and <code>client.ts</code> were generated using the following commands:</p>
  <pre><code>Using keytool, create a certificate for the broker:
      keytool -genkey -alias broker -keyalg RSA -keystore broker.ks
  
  Export the broker's certificate so it can be shared with clients:
      keytool -export -alias broker -keystore broker.ks -file broker_cert
  
  Create a certificate/keystore for the client:
      keytool -genkey -alias client -keyalg RSA -keystore client.ks
  
  Create a truststore for the client, and import the broker's certificate. This establishes that the client &quot;trusts&quot; the broker:
      keytool -import -alias broker -keystore client.ts -file broker_cert
  </code></pre>
  <p>And that's all I did to enable SSL on my localhost broker, and I'm not sure if there's anything else I need to do besides adding that <code>&lt;sslContext&gt;</code> element to my config.</p>
  <p>When I try starting the localhost broker after having made that change, I now get a different error in <code>activemq.log</code>:</p>
  <pre><code>2021-01-29 20:07:03,686 | INFO  | Error with pending remote brokerInfo on: 
     ssl://###.mq.ca-central-1.amazonaws.com/##.###.#.106:61617 (Connection or inbound has closed) |
     org.apache.activemq.network.DemandForwardingBridgeSupport | ActiveMQ Transport: ssl://###.mq.ca-
     central-1.amazonaws.com/##.###.#.106:61617
  
  2021-01-29 20:07:03,687 | WARN  | Could not start network bridge between: vm://localhost and: 
     ssl://###.mq.ca-central-1.amazonaws.com:61617 due to: sun.security.validator.ValidatorException: 
     PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find 
     valid certification path to requested target | org.apache.activemq.network.DiscoveryNetworkConnector | 
     Simple Discovery Agent-3
  </code></pre>
  <p>And this is where I'm stumped.</p>
  <p>Does anyone know what I'm doing wrong? I don't see anything SSL related in the AWS broker's config, and I'm assuming that's because AWS has intentionally hid that from me to prevent me from changing any of the SSL settings for that broker.</p>
  <p>Do I need to somehow get a hold of the SSL cert used by the AWS broker and add that to my localhost broker? I have no clue what to do next.</p>
  <p><strong><em>Update</em>: I used Portecle download the SSL certs from the AWS broker and added them to <code>client.ts</code>.</strong></p>