0

Can Apache ActiveMQ Artemis (v2.13.0) use an updated TLS certificate while running, or does it require a restart? I did not find something about it in Configuring Transports and Configuration Reload sections.

When aiming towards short-living TLS certificates, any restart causes unwanted service interruptions.

Stephan
  • 275
  • 2
  • 7

1 Answers1

1

In version 2.10.0 if the keystore and/or truststore are updated at runtime then those changes will be reflected automatically in the broker without requiring a restart. The new values will be applied to new connections only. Existing connections will continue to work since they already performed a valid SSL/TLS handshake.

Please note that this behavior changed in the 2.18.0 release due to an SSL performance issue. Instead of updating automatically you'll need to invoke the reload operation on the acceptor via the management API (e.g. web console, JMX, HTTP via Jolokia, etc.).

jbertram
  • 208
  • 1
  • 4
  • According to [release notes for v2.18.0](https://activemq.apache.org/components/artemis/documentation/latest/versions.html#2180) and a [performance issue observed with JDK 11](https://issues.apache.org/jira/browse/ARTEMIS-3117) this no longer holds true. Instead, the TLS certificate can be reloaded via JMX. – Stephan Nov 17 '21 at 16:11
  • @Stephan, that's correct. I'll update my answer. – jbertram Nov 18 '21 at 21:23