IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

ActiveMQ BrokerService[detachedBroker - Received fatal alert: certificate_unknown (Received fatal alert: certificate_unknown)

  • 1.  ActiveMQ BrokerService[detachedBroker - Received fatal alert: certificate_unknown (Received fatal alert: certificate_unknown)

    Posted 15 days ago
    Edited by Lucian Sipos 15 days ago

    Hello all

    We recently renewed the certificates on Resilient and now, in resilient-messaging.log, we have this error in polling:

    09:47:09.541 [ActiveMQ BrokerService[detachedBroker] Task-2573] WARN  v=unknown  o.a.a.broker.TransportConnector - Could not accept connection from tcp://QRADAR_CONSOLE_IP:PORT: Received fatal alert: certificate_unknown (Received fatal alert: certificate_unknown)

    Someone know where we can look to investigate further?

    Other logs (client, various resilient-*) are ok, no errors.

    Restarting resilient-messaging service doesn't solve the problem (STOMP errors after importing a new SSL certificate in to IBM Resilient)

    Thanks



    ------------------------------
    Lucian Sipos
    ------------------------------



  • 2.  RE: ActiveMQ BrokerService[detachedBroker - Received fatal alert: certificate_unknown (Received fatal alert: certificate_unknown)

    Posted 9 days ago

    Hi Lucian,

    Which app is this affecting? Do you have the QRadar SOAR plugin installed in SIEM and now you are facing issues with it or is this a different app?

    Thanks



    ------------------------------
    Priya Sapra
    ------------------------------

    Original Message


  • 3.  RE: ActiveMQ BrokerService[detachedBroker - Received fatal alert: certificate_unknown (Received fatal alert: certificate_unknown)

    Posted 9 days ago

    Solution was to install the certificate of the server where SOAR is running to the machine where QRadar is running.



    ------------------------------
    Lucian Sipos
    ------------------------------

    Original Message