🎄 Happy Holidays! 🥳

Most of Solace is closed December 24–January 1 so our employees can spend time with their families. We will re-open Thursday, January 2, 2024. Please expect slower response times during this period and open a support ticket for anything needing immediate assistance.

Happy Holidays!

Please note: most of Solace is closed December 25–January 2, and will re-open Tuesday, January 3, 2023.

Message Signing Questions

dreamoka
dreamoka Member Posts: 56 ✭✭✭
in General Discussions #1

Are the message broker able to verify message signing ?

For example, Client A signed the message and sent the message to message broker. Then, the message broker check the message and reject the message if the message contain incorrect message signature.

Tagged:

Comments

  • Tamimi
    Tamimi Member, Administrator, Employee Posts: 541 admin
    #2

    Hey @dreamoka - the broker dos not intercept any of the payload, it simply just route the message to the destination. Any payload processing such as checksum and signature validation is done on the receiving application. In the cases of failed validation the consuming application could either NACK of drop the message

  • dreamoka
    dreamoka Member Posts: 56 ✭✭✭
    #3

    Hi @Tamimi , thank you so much. I am not well versed in term of security. I have the following questions to ask.

    1. Do i still implement message signing If message broker implements mutual TLS (mTLS) authentication?
    2. Is it a recommendation to use mutual TLS (mTLS) rather than basic authentication (username and password)?
    3. Based on your opinion, who is the one should generate client certificate ? Is it I have to generate client certificate for all the client since certificate contains username ?
    4. Does mutual TLS (mTLS) is a good way for preventing client spoofing?


Categories

This Month's Leaders

This Week's Leaders