Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To accept encrypted AMQP 1.0 connections, configure an Apache ActiveMQ Artemis Netty acceptor with both protocols=AMQP and sslEnabled=true. The broker needs a keystore containing its private key and certificate; clients need to trust that certificate’s issuing CA (or the certificate itself). The usual port is 5671, but the port is configurable. This guide covers a one-way TLS setup first, then mutual TLS, client configuration, verification, and troubleshooting. It targets Artemis, not ActiveMQ Classic.
How the connection is put together
An Artemis acceptor listens for incoming client connections. A connector describes a connection to a remote endpoint. AMQP 1.0 is the messaging protocol; TCP/Netty carries it, and TLS protects that transport and lets peers verify identity. On the broker, this is a TCP acceptor restricted to AMQP with TLS enabled—not a separate Artemis “AMQPS protocol.” See the Artemis acceptor and connector terminology and protocol documentation.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Instant Apache ActiveMQ Messaging Application Development How-to | $10.69 | Buy on Amazon |
| 2 |
|
ActiveMQ in Action | $40.14 | Buy on Amazon |
| 3 |
|
Apache Delivery Service | $13.90 | Buy on Amazon |
AMQP 1.0 client
|
| TLS over TCP (commonly port 5671)
|
Artemis AMQP-only acceptor
|
Artemis authentication and address/queue authorizationArtemis documentation currently identifies the latest user manual as version 2.55.0. Match configuration to the exact release you operate, since transport defaults and behavior can change. The examples here use the current documented plural parameter protocols=AMQP; older documentation may show protocol=AMQP.
Choose one-way TLS or mutual TLS
| Mode | What each side proves | What you configure | Operational trade-off |
|---|---|---|---|
| One-way TLS | The broker proves its identity to the client. | Broker keystore; client trusts the certificate or its CA. AMQP credentials can separately authenticate users. | Simpler client onboarding and certificate rotation. |
| Mutual TLS (mTLS) | The broker and each client prove their identities with certificates. | All one-way TLS settings, plus a broker truststore and a client private-key certificate; require client authentication on the acceptor. | Useful when client certificates are part of access control, but requires issuance, renewal, trust management, and client certificate selection. |
Use mTLS when certificate identity is an intentional part of your security model. Otherwise, one-way TLS plus AMQP authentication is generally less complex to operate. TLS transport security and broker permissions are distinct controls; Artemis authentication and authorization are described in its security documentation.
#1 Best Overall
Prepare the broker certificate and keystore
For production, obtain a certificate from a public or enterprise CA appropriate to your deployment. The certificate must contain a Subject Alternative Name (SAN) matching the DNS name clients use, such as DNS:broker.example.com. Do not rely on the Common Name alone. Clients must trust the issuing CA chain, and the broker should present the required chain. Keep private keys and passwords out of source control.
For isolated local testing, Java’s keytool can create a self-signed PKCS#12 keystore and export its certificate. This is a demonstration example, not a recommended production certificate workflow; replace the example password and hostname.
keytool -genkeypair
-alias broker
-keyalg RSA
-keysize 2048
-storetype PKCS12
-keystore broker-keystore.p12
-storepass changeit
-keypass changeit
-validity 365
-dname "CN=broker.example.com, OU=Messaging, O=Example, C=US"
-ext "SAN=dns:broker.example.com"
keytool -exportcert
-rfc
-alias broker
-keystore broker-keystore.p12
-storetype PKCS12
-storepass changeit
-file broker.crt
keytool -importcert
-noprompt
-alias broker
-file broker.crt
-keystore client-truststore.p12
-storetype PKCS12
-storepass changeitThe exported certificate is imported into the client truststore for this self-signed test. With a CA-issued certificate, clients normally trust the relevant CA rather than importing each broker certificate. Artemis supports store types including JKS, JCEKS, PKCS12, and PEM; its documented default is JKS. Set the type explicitly when using PKCS#12, and inspect the resulting store with keytool -list. See Artemis transport configuration.
Configure an AMQP-only TLS acceptor
Edit <broker-instance>/etc/broker.xml and add or update the <acceptors> section. This single-line form avoids whitespace and line-break ambiguity in the URI:
<acceptors>
<acceptor name="amqp-ssl">tcp://0.0.0.0:5671?protocols=AMQP;sslEnabled=true;keyStorePath=${artemis.instance}/etc/broker-keystore.p12;keyStorePassword=changeit;keyStoreType=PKCS12;sslHandshakeTimeout=10</acceptor>
</acceptors>Replace the sample password with a deployment-managed secret and ensure the broker process can read the keystore. URI parameters are separated by semicolons; protocols=AMQP restricts this acceptor to AMQP, while omitting protocols may allow other configured protocols. The conventional AMQP-over-TLS port is 5671 and plaintext AMQP commonly uses 5672, but Artemis does not require either number: the client, firewall, and acceptor must agree. The sslHandshakeTimeout value shown is seconds; current transport documentation lists 10 seconds as the default and 0 as disabling the timeout.
A dedicated AMQP listener is easier to document, monitor, and restrict at the firewall than a generic multi-protocol endpoint. If another listener is required, keep its exposure intentional. For example:
<acceptors>
<acceptor name="core">tcp://0.0.0.0:61616?protocols=CORE</acceptor>
<acceptor name="amqp-ssl">tcp://0.0.0.0:5671?protocols=AMQP;sslEnabled=true;keyStorePath=${artemis.instance}/etc/broker-keystore.p12;keyStorePassword=changeit;keyStoreType=PKCS12</acceptor>
</acceptors>Optional: require client certificates
For mTLS, add the broker’s truststore and require client authentication:
Free tools Windows power users keep installed
One-click scans. No signup required.
<acceptor name="amqp-mtls">tcp://0.0.0.0:5671?protocols=AMQP;sslEnabled=true;keyStorePath=${artemis.instance}/etc/broker-keystore.p12;keyStorePassword=changeit;keyStoreType=PKCS12;trustStorePath=${artemis.instance}/etc/client-truststore.p12;trustStorePassword=changeit;trustStoreType=PKCS12;needClientAuth=true</acceptor>needClientAuth=true requires clients to present certificates the broker trusts. wantClientAuth=true requests a certificate without requiring one; if both options are configured, needClientAuth takes precedence. A client certificate is not just a trusted certificate in a store: the client must have the corresponding private key and present an acceptable chain. Refer to the transport configuration reference for the supported TLS options.
Start Artemis and check the TLS listener
-
Start in the foreground from the broker instance to inspect startup output:
cd <broker-instance> && ./bin/artemis run. Alternatively, start it in the background with./bin/artemis start. -
Check the broker logs for the acceptor starting on the configured port. Exact log wording varies by version and transport implementation; confirm the intended AMQP acceptor is active.
-
On Linux, check that the port is listening:
ss -ltnp | grep 5671. Also verify DNS resolution, firewall rules, security groups, and any load-balancer path from the client network.Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Rank #2
-
Test TLS and the certificate presented by the endpoint:
openssl s_client -connect broker.example.com:5671 -servername broker.example.com -showcertsThe
-servernamevalue sends the DNS name for SNI. A successful TLS handshake establishes that the socket and TLS layer negotiated; it does not prove AMQP login, authorization, or message delivery.
Configure an AMQP 1.0 client
Use an AMQP 1.0-capable library; a client limited to AMQP 0-9-1 cannot connect as an AMQP 1.0 client. A Qpid JMS-style URI commonly takes this form:
amqps://broker.example.com:5671The exact URI and TLS properties depend on the client library. The client must trust the broker certificate, verify that its hostname matches the certificate SAN, and supply valid broker credentials if user/password authentication is enabled. Trust may come from a client-specific SSL context, a truststore, or the JVM’s configured truststore.
Recommended Free Tools
For a Java test process using the sample PKCS#12 truststore:
java
-Djavax.net.ssl.trustStore=/path/client-truststore.p12
-Djavax.net.ssl.trustStorePassword=changeit
-Djavax.net.ssl.trustStoreType=PKCS12
-jar amqp-test-client.jarFor mTLS, also provide a client keystore with a private key and certificate:
java
-Djavax.net.ssl.trustStore=/path/client-truststore.p12
-Djavax.net.ssl.trustStorePassword=changeit
-Djavax.net.ssl.trustStoreType=PKCS12
-Djavax.net.ssl.keyStore=/path/client-keystore.p12
-Djavax.net.ssl.keyStorePassword=changeit
-Djavax.net.ssl.keyStoreType=PKCS12
-jar amqp-test-client.jarUse the client library’s supported mechanism to set the AMQP username and password as well. TLS encryption, server identity validation, client-certificate identity, and AMQP authentication are separate parts of the connection.
Test the full path, not just the port
Check each layer in order so that a failure points to the right configuration area:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
-
DNS and routing: the client resolves the intended broker name and can reach the configured host and port.
-
TCP: a connection reaches the listener. A port scan or socket test alone says nothing about TLS or AMQP.
-
TLS: the client trusts the chain, the certificate is valid for the requested hostname, and any required client certificate is accepted.
Rank #3
-
AMQP negotiation: the client library negotiates AMQP 1.0 with the AMQP-restricted acceptor.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Authentication: the broker accepts the supplied user credentials or configured certificate identity.
-
Authorization and messaging: the user’s role permits the intended send/consume operations, and a real producer and consumer can exchange a message using the intended address or queue.
Troubleshoot common failures
| Symptom | Likely cause | What to check or change |
|---|---|---|
SSLHandshakeException: PKIX path building failed |
The client does not trust the issuing CA or self-signed broker certificate, the server omitted an intermediate certificate, or the process uses a different truststore than expected. | Inspect the configured store with keytool -list -v -keystore client-truststore.p12 -storetype PKCS12 -storepass changeit. Confirm the right CA/certificate is present and that the client process uses that store. |
| Hostname verification failure | The hostname or IP used by the client does not appear in the certificate SAN. | Issue a certificate containing the DNS SAN clients use, or connect using the intended certificate hostname. Do not disable hostname verification as a normal production fix. |
Unrecognized SSL message or an immediate protocol error |
One side expects plaintext while the other expects TLS, or a proxy/load balancer terminates TLS differently than expected. | Use openssl s_client to determine whether the port begins TLS. Check that the acceptor has both protocols=AMQP and sslEnabled=true, and configure the client’s TLS URI/settings for that listener. |
handshake_failure |
Possible TLS-version or cipher mismatch, incompatible certificate algorithm, a missing required client certificate, or an untrusted client certificate chain. | Test a supported TLS version, for example with openssl s_client -connect broker.example.com:5671 -servername broker.example.com -tls1_2. For Java clients, temporarily add -Djavax.net.debug=ssl,handshake; disable verbose diagnostics after troubleshooting. |
| mTLS client certificate rejected | The client lacks a private-key entry, the chain or certificate use is unsuitable, the broker truststore does not trust its issuer, or client authentication was enabled unintentionally. | Verify the client keystore contains the key and certificate, the chain is complete, and broker truststore path, password, type, and needClientAuth are correct. |
| Broker starts but the acceptor fails or is absent | Malformed XML/URI, unreadable store, incorrect password or path, unresolved instance path, or a port already in use. | Inspect startup logs, validate the XML and semicolon-separated URI, check file permissions and store contents, and confirm no other process owns the port. |
| Login works but send or consume fails | Artemis authorization or address/queue routing, not TLS. | Check the user’s role and permissions for the target address and queue, and verify the client’s address and queue names match the broker’s routing configuration. |
Older Artemis material may describe options such as verifyHost=false; that is a narrowly scoped diagnostic or compatibility workaround, not a sound default. See the historical Artemis version documentation.
Operate the configuration safely
-
Keep secrets out of images and repositories. Protect the keystore, private key, and passwords with your deployment’s secret-management mechanism and restrict file access to the broker process.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Restrict network exposure. Open only the selected TLS port to intended clients. Avoid unintentionally exposing a plaintext listener or a generic listener that accepts more protocols than the workload needs.
-
Set an explicit TLS policy when required. Artemis supports
enabledProtocolsandenabledCipherSuites; when omitted, JVM defaults apply. Confirm compatibility with the exact runtime and clients before narrowing either setting. -
Plan certificate renewal. Stage and inspect the renewed store with
keytool -list, verify the alias and chain, then replace it safely. Artemis transport documentation listssslAutoReloadas disabled by default; set it only after confirming the deployed version’s behavior, or schedule a controlled restart. -
Choose TLS termination deliberately. If a proxy or load balancer terminates TLS, decide whether its backend connection is also encrypted and where client identity is verified. Do not assume the broker sees the original client certificate after termination.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
For containers or Kubernetes, mount stores as secrets. Avoid baking private keys into images. ArtemisCloud’s TLS broker setup demonstrates an operator-oriented pattern using mounted secrets and acceptor parameters; use the operator’s configuration model rather than copying VM paths unchanged.
Keep Artemis and ActiveMQ Classic configuration separate
ActiveMQ Classic and ActiveMQ Artemis are related but distinct brokers with different configuration models. Classic documentation uses transport connectors such as <transportConnector>; Artemis configures incoming connections with acceptors in broker.xml. Do not paste Classic connector examples into an Artemis instance. See ActiveMQ Classic AMQP documentation for the separate product’s model. Artemis AMQP broker connections are also a different subject from client-facing acceptors; see its AMQP broker connections documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
