How to generate a new Bamboo ActiveMQ broker certificate using automatic keystore management

Summary

If you have secured your agents following the steps inside the Securing your remote agents > Configure your Bamboo server to use SSL page by simply updating the protocol to SSL in the Broker URL and Broker Client URL inside the <bamboo-home>/bamboo.cfg.xml file Bamboo will have automatically set up the key and trust stores and distributed certificates to your agents the first time they connected to the server. This feature is called automatic keystore management.

This page describes how to verify the details of the (existing) certificate and generate a new one if necessary. There are a few caveats though so please make sure to read through the following:

• This page is not meant for you if you have disabled automatic keystore management using the following Java property in your Bamboo instance:

  1 -Dbamboo.manage.jms.ssl=false

• If you have disabled automatic keystore management and have set the Broker URL and Broker Client URL to use SSL then you are likely using your own certificate to secure your agents. This page is also not meant for you since the process you will need to follow to generate a new certificate is very different from the one used by the automatic keystore management. If you're looking for steps on how to secure your agents using your own certificate have a look at the following page: https://confluence.atlassian.com/bamkb/how-to-secure-your-remote-agent-bamboo-server-757465762.html.

Environment

Bamboo versions 5.10 and higher.

Solution

Verifying Bamboo ActiveMQ broker certificate details

In order to verify the certificate details (e.g. owner, expiry date and etc) and see whether you should generate a new one you can use the following options:

openSSL

keytool

1. Navigate to the <bamboo-shared-home>/configuration directory.

2. Run the following command:

   1 keytool -v -list -keystore broker.ks -alias jmsbrokerkey

Generating a new Bamboo ActiveMQ broker certificate

In order to generate a new certificate and make sure that it is propagated to your existing agents you will have to:

Bamboo

1. Stop Bamboo.

2. Navigate to the <bamboo-shared-home>/configuration directory.

3. Delete the broker.ks file (or move it to another folder in the server, in case you want to have a backup file).

4. Start Bamboo.

   1. Bamboo will automatically generate a new certificate due to the automatic keystore management feature.

Agent(s)

1. Stop agent.

2. Navigate to the <bamboo-agent-home>/configuration folder.

3. Delete the jmsclient.ks and jmsclient.ts files (or move them to another folder in the server, in case you want to have backup files).

4. Start agent.

   1. The agent will receive the new certificate from Bamboo during startup.

You must do this to every agent connected to Bamboo after generating a new certificate otherwise agents will fail to establish a successful connection to Bamboo with the following errors:

<bamboo-agent-home>/atlassian-bamboo-agent.log

There's a feature request asking for a change in this behaviour and to facilitate the process of generating new certificates here:

BAM-21721 - Distribute certificate to all agents that have been previously approved after generating a new Bamboo ActiveMQ broker certificate