Event Stream Solace connector TLS connection

[robjackson]

we would like to connect an Event Stream connector to Solace PubSub+ JMS queue over Secure transport, TLS.

Using "tcps://Host.domain:Port"

The error message when we configure this target queue that we see in the Event Stream logs is:

   "Message": {        "value": "Task: '004a7630-43fa-46e7-8683-149dcc595d6b-task#0' failed. Details: org.apache.kafka.connect.errors.ConnectException: Failed to create JCSMPSession

Caused by: com.solacesystems.jcsmp.InvalidPropertiesException: Unable to load trust store: /lib/security/jssecacerts

Caused by: java.io.FileNotFoundException: /lib/security/jssecacerts (No such file or directory)",        

"type": "string"

The Solace queue target system is not under our control and they require a TLS connection to the Solace queue via tcps:// 

Could you let us know when this might be available for Event Stream Solace connector?

This seems like a simple, low-hanging fruit, feature that will help us quite a bit, i.e. installation of the standard cacerts file in the defined directory for event stream (kafka).... literally copy and paste a well known file into a directory where it is expected to be found.

Thanks for your consideration

[v-ssriganesh]

Hi @robjackson,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.

[v-ssriganesh]

Hi @robjackson,

May I ask if you have resolved this issue? If so, please mark it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[burakkaragoz]

Hi @robjackson ,

You can follow the steps below to resolve the issue you are experiencing when trying to connect the Event Stream connector to the Solace PubSub+ JMS queue over secure transport (TLS):

Upload the Security Certificate File:

We see that the “jssecacerts” file mentioned in the error message is missing. You need to upload this file to the correct directory.
Copy the certificate file to the /lib/security/jssecacerts directory. This file usually contains Java's security certificates.
Determine the correct file path:

If you want to change the file path, make sure you specify the correct file path in the connector configuration.
For example:

trustStorePath=/path/to/your/jssecacerts

Connector Configuration:

Correctly set the required settings for the TLS connection in the connector configuration. These settings should usually be in the format tcps://host.domainPort.
Installing the Certificate File Correctly:

Ensure that the certificate file is correctly installed and accessible. Make sure the file has the correct permissions.
By following these steps, you can resolve the TLS connection issue and successfully connect the Event Stream connector to the Solace PubSub+ JMS queue.

[v-ssriganesh]

Hi @robjackson,
Thank you for posting in the Microsoft Fabric Community Forum with details about the Solace connector issue.

The error you’re seeing means the Solace connector can’t find a trust store file (expected at /lib/security/jssecacerts) needed to secure the TLS connection to the Solace server. This file holds certificates to verify the server’s identity.

The Solace PubSub+ connector in Event Streams supports TLS connections, but it requires a trust store file to be set up correctly. The Fabric environment doesn’t include a default trust store, which causes the error. Your idea to add a standard trust store file (like cacerts) is a great suggestion to simplify this, but this feature isn’t available yet, and we don’t have a confirmed timeline for it.

To fix the TLS connection issue:

• Ask the Solace system administrator for the server’s certificate or the certificate authority (CA) certificate that signed it. If the server uses a public CA, a standard Java trust store (cacerts) might work.
• If the certificate is self-signed or from a private CA, work with your IT team to create a trust store file (a Java KeyStore or JKS file) containing the certificate. If using a standard cacerts file, locate it from a Java installation or ask your IT team for one.
• In the Event Streams connector settings, specify the path to your trust store file and its password (provided by your IT team).

Save and restart the connector and check the Event Stream logs to ensure the TLS connection works. If not, verify the certificate details with the Solace administrator.

If this information is helpful, please “Accept as solution” and give a "kudos" to assist other community members in resolving similar issues more efficiently.
Thank you.

[robjackson]

The target queue I wish to connect to uses a public CA cert, so the standard cacerts file should work. However, I don't see any place to specify a path to a file in the connection configuration, nor do I know how to upload a file to the Fabric environment.

[v-ssriganesh · Accepted solution]

Hi @robjackson,

Thank you for the update. Since the Solace server uses a public CA certificate, the standard Java cacerts file should work. Below are steps to address the missing trust store path in the Event Streams UI and uploading the file to Fabric.

Consider the below steps:

• Ask your IT team for the cacerts file from a Java installation’s lib/security folder.
• In your Fabric workspace, go to “Create” > “Environment” (or edit an existing one) and in the “Resources” section, upload the cacerts file and note its path (e.g., /env/cacerts).
• In the Event Streams connector settings, check for an “Advanced” or “Custom Properties” section to enter the trust store path and password (“changeit” by default).
• Save and restart the connector, then check Event Stream logs to confirm the TLS connection works.

Visit the Solace Community for additional tips on configuring the Solace JMS connector with a trust store: Solace Community

If this response helps, consider marking it as “Accept as solution” and giving a “kudos” to assist other community members.
Thank you.

[v-ssriganesh]

Hi @robjackson,
I hope this information is helpful. Please let me know if you have any further questions or if you'd like to discuss this further. If this answers your question, please accept it as a solution and give it a 'Kudos' so other community members with similar problems can find a solution faster.
Thank you.