search

iitsoftware / swiftmq-ce

SwiftMQ Community Edition
Apache License 2.0
16 stars 0 forks source link

Upgarde of TLS 1.2 to TLS 1.3 for version SwiftMQ version 9.3.1 failing #100

Closed surojit214 closed 1 year ago

surojit214 commented 1 year ago

Have been using SwiftMQ 9.3.1 with TLS 1.2. Recently updated it to TLS 1.3 and the inter router network seems to have been broken across routers after upgrade to 1.3. Things have been working fine in the past with a custom implementation to "ssl-engine-factory-class" at the network swiftlet layer. Even now after upgrade to TLS 1.3, the Handshake seems to be working fine, but getting an exception: "javax.net.ssl.SSLProtocolException: Receiving application data before handshake complete". And the issue that is being observed is that the router and not interconnected, even with multiple configuration being available at the "routing" swiftlet level. Any help is appreciated.

edgebroker commented 1 year ago

did you try with the latest release 12.5.4?

9.3.1 is too old.

surojit214 commented 1 year ago

True, but we don't have the option to upgrade it to latest, and have to stick to 9.3.1 only

edgebroker commented 1 year ago

What about using an SSH tunnel instead?

surojit214 commented 1 year ago

Like mentioned above, we have overridden the "ssl-engine-factory-class" at the network swiftlet layer and it was working fine for TLS 1.2. After upgrade to TLS 1.3, what we are noticing is that the inter router network connection gets broken(have made the change at the engine level to support TLS 1.3 as well). We have verified the behaviour by enabling JMS and looking into the "sys$net -> usages -> connections" which comes as blank, even when multiple connectors are configured. Any help or suggestion is really appreciated. Upgrade to latest version is not an option. Would like to hear any suggestion from code perspective that can be looked into to find the root cause of the issue and to fix it.

iitsoftware commented 1 year ago

AFAIK, you are using SwiftMQ UR/HA but not CE. Only CE is open source so you can't fix UR/HA without violating our license.

Never heard that someone has to stay at a particular release. If so, then accept the limits of that release or upgrade.

Issue closed.