Apache Artemis 2.57.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Apache Artemis 2.57.0 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2. Choose m5.large, your key pair and a security group as above.

The broker keeps its message journal on the root volume. Give the instance a root volume sized for the messages you expect to hold (Step 13).

To launch with the AWS CLI, run the following and replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=30,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=artemis}]'

First boot takes about a minute after the instance is running. The boot service creates the admin user and the certificate, then the broker and nginx start.

Version SSH user

Apache Artemis 2.57.0 on Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

systemctl is-active artemis-firstboot artemis nginx
sudo test -f /var/lib/sac/data/artemis-firstboot.done && echo FIRSTBOOT_DONE

All three units are active and the first boot marker is present:

active active active FIRSTBOOT_DONE

Only SSH, nginx and the broker's TLS port listen on network interfaces. The web console listens on the loopback address:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | grep -v '127.0.0.5' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort

*:61617 users:(("java")) 0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) [::]:22 users:(("sshd"),("systemd")) [::]:443 users:(("nginx"),("nginx"),("nginx")) [::]:80 users:(("nginx"),("nginx"),("nginx")) [::ffff:127.0.0.1]:8161 users:(("java"))

sudo cat /root/artemis-credentials.txt

The file is readable by root only:

# Apache Artemis 2.57.0 on Ubuntu 24.04 - generated on first boot by artemis-firstboot.service.
# The admin password below is unique to this instance; none was baked into the image. Keep this file secret.
# Web console: open ARTEMIS_CONSOLE_URL and log in as ARTEMIS_ADMIN_USER.
# Messaging clients (CORE, AMQP 1.0, OpenWire) connect over TLS to port 61617 and trust ARTEMIS_TLS_CERT
# (a self-signed certificate minted on this instance; replace it with your own, see the user guide).
# Change the served name:
sudo artemis-set-hostname <dns-name> ARTEMIS_CONSOLE_URL=https://<public-ip>/console/ ARTEMIS_ADMIN_USER=admin ARTEMIS_ADMIN_PASSWORD=<ARTEMIS_ADMIN_PASSWORD> ARTEMIS_BROKER_HOST=<public-ip> ARTEMIS_CORE_URL=tcp://<public-ip>:61617?sslEnabled=true;trustStoreType=PEM;trustStorePath=/etc/artemis/broker.crt ARTEMIS_AMQP_URL=amqps://<public-ip>:61617 ARTEMIS_OPENWIRE_URL=ssl://<public-ip>:61617 ARTEMIS_TLS_CERT=/etc/artemis/broker.crt
# Re-verify the appliance:
sudo artemis-selfcheck
# User guide: https://secureanycloud.com/stacks/apache-artemis-2-57-0/

The host is the instance's public IP address from the EC2 instance metadata (the private address when the instance has no public one). The certificate also names the public DNS name and the private IP address and DNS name, so clients inside the VPC can connect by the private address.

If you stop and start the instance without an Elastic IP, the boot service picks up the new address and issues a new certificate for it. To serve the broker under your own DNS name, see Step 9.

Open https://<public-ip>/console/ in a browser. The certificate is self-signed, so the browser asks you to accept it the first time, or you can install your own (Step 9). Log in as admin with the password from the credentials file.

The Status tab shows the broker version, uptime, memory and disk use, and the acceptor:

Queues lists every queue with its routing type and message count. Select a queue to browse, send, move or delete messages. Addresses shows the addresses queues are bound to. Connections, Sessions, Producers and Consumers show live clients:

The Artemis command line client is installed in /opt/artemis/current/bin. Send ten messages to a queue named orders over TLS. The command connects without a password first, then asks for it. Paste the admin password at the Type the password for a retry prompt. The password is not echoed:

/opt/artemis/current/bin/artemis producer --user admin --destination queue://orders --message-count 10 \
  --url 'tcp://127.0.0.1:61617?sslEnabled=true;trustStoreType=PEM;trustStorePath=/etc/artemis/broker.crt'

Connection brokerURL = tcp://127.0.0.1:61617?sslEnabled=true;trustStoreType=PEM;trustStorePath=/etc/artemis/broker.crt Connection failed::AMQ229031: Unable to validate user from 127.0.0.1:<port>. Username: admin; SSL certificate subject DN: unavailable --password: is mandatory with this configuration: Type the password for a retry Producer ActiveMQQueue[orders], thread=0 Produced: 10 messages

Receive them again:

/opt/artemis/current/bin/artemis consumer --user admin --destination queue://orders --message-count 10 \
  --url 'tcp://127.0.0.1:61617?sslEnabled=true;trustStoreType=PEM;trustStorePath=/etc/artemis/broker.crt'

Consumer ActiveMQQueue[orders], thread=0 Consumed: 10 messages

The broker creates a queue the first time a client uses it (auto-create-queues), so orders now appears in the console. Avoid --password on the command line, because other users on the instance could see it in the process list.

Clients outside the instance connect to <public-ip>:61617 (or the private address inside the VPC) over TLS and must trust the instance's certificate. Copy the certificate to the client machine:

scp -i <your-key.pem> ubuntu@<public-ip>:/etc/artemis/broker.crt artemis-broker.crt

Connection settings for the three protocols (user admin, password from the credentials file, or a user you create in Step 10):

Protocol Clients URL

CORE Artemis JMS / Jakarta Messaging client, artemis CLI tcp://<host>:61617?sslEnabled=true;trustStoreType=PEM;trustStorePath=artemis-broker.crt

AMQP 1.0 Qpid JMS, Qpid Proton (Python, C, .NET), rhea (JavaScript), go-amqp amqps://<host>:61617 with the certificate as the trusted CA

OpenWire ActiveMQ "Classic" 5.x clients ssl://<host>:61617 with the certificate in the client's trust store

A Java client using the Artemis JMS client library:

ConnectionFactory cf = new ActiveMQConnectionFactory( "tcp://<host>:61617?sslEnabled=true;verifyHost=true;trustStoreType=PEM;trustStorePath=/path/to/artemis-broker.crt"); try (Connection c = cf.createConnection("admin", System.getenv("ARTEMIS_PASSWORD"))) { ... }

A Python client using Qpid Proton (pip install python-qpid-proton):

from proton import SSLDomain from proton.utils import BlockingConnection ssl = SSLDomain(SSLDomain.MODE_CLIENT); ssl.set_trusted_ca_db("artemis-broker.crt"); ssl.set_peer_authentication(SSLDomain.VERIFY_PEER_NAME) conn = BlockingConnection("amqps://<host>:61617", ssl_domain=ssl, user="admin", password=os.environ["ARTEMIS_PASSWORD"], allowed_mechs="PLAIN")

Java clients that use a PKCS12 trust store instead of PEM can build one from the certificate with keytool -importcert -file artemis-broker.crt -keystore artemis-trust.p12 -storetype PKCS12.

If clients connect by a DNS name, set that name first (Step 9) so the certificate matches it.

Everything the console does goes through the Jolokia management API at https://<host>/console/jolokia/. Scripts can call it with HTTP Basic authentication. The request must carry an Origin header naming this instance (https://<host>), because Jolokia refuses requests from any other origin. Keep the password out of the command line by putting it in a curl configuration file readable only by you:

umask 077;
sudo sed -n 's/^ARTEMIS_ADMIN_PASSWORD=//p' /root/artemis-credentials.txt | { read -r P; printf 'user = "admin:%s"\n' "$P"; } > ~/.artemis-curl
H=$(sudo sed -n 's/^ARTEMIS_BROKER_HOST=//p' /root/artemis-credentials.txt)
curl -sk -K ~/.artemis-curl -H "Origin: https://$H" --connect-to "$H:443:127.0.0.1:443" \
  "https://$H/console/jolokia/read/org.apache.activemq.artemis:broker=%22artemis%22/Version"; echo rm -f ~/.artemis-curl

{"request":{"mbean":"org.apache.activemq.artemis:broker=\"artemis\"","attribute":"Version","type":"read"},"value":"2.57.0","timestamp":<timestamp>,"status":200}

nginx limits requests that carry an Authorization header to 30 per minute per client address (bursts of 30 are allowed), so a script cannot be used to guess passwords. For monitoring, use a dedicated user (Step 10).

Point a DNS record at the instance, then tell Artemis to serve that name. This updates nginx and issues a new self-signed certificate that names it (used by both the console and the broker port). It also accepts https://<name> as an allowed origin for the console and the management API, updates the URLs in the credentials file and restarts the broker:

sudo artemis-set-hostname mq.example.com

The name is saved in /etc/sac/artemis-hostname and survives reboots. Clients then trust the new /etc/artemis/broker.crt.

To use a certificate from your own CA or from Let's Encrypt for both the console and the broker, install it in these four places. Then restart the broker and reload nginx:

sudo install -o root -g root -m 0600 server.key /etc/nginx/ssl/artemis.key
sudo install -o root -g root -m 0644 fullchain.crt /etc/nginx/ssl/artemis.crt cat server.key fullchain.crt | sudo install -o root -g artemis -m 0640 /dev/stdin /etc/artemis/tls/broker.pem
sudo install -o root -g root -m 0644 fullchain.crt /etc/artemis/broker.crt
sudo systemctl restart artemis && sudo systemctl reload nginx

/etc/artemis/tls/broker.pem holds the private key followed by the certificate chain (the broker reads it as a PEM key store). If you later run artemis-set-hostname again, it replaces these files with a new self-signed certificate.

Users live in /var/lib/artemis/etc/artemis-users.properties and their roles in artemis-roles.properties. Passwords are stored as Artemis PBKDF2 hashes, ENC(1024:<salt>:<hash>), never in plain text. The amq role holds every messaging and management permission. The broker re-reads both files automatically, so no restart is needed.

To add a user, run the block below. It reads the new password without echoing it, computes the hash and appends the user with the amq role. The password reaches Python on standard input, never the command line. For narrower permissions, add a role of your own to the security-settings in broker.xml (see the Artemis security documentation):

read -rp 'New user name: ' U; read -rsp "Password for $U: " P; echo printf '%s' "$P" | sudo python3 -I -c ' import hashlib, os, sys u, p = sys.argv[1], sys.stdin.read() s = os.urandom(32) h = hashlib.pbkdf2_hmac("sha1", p.encode(), s, 1024, 64) open("/var/lib/artemis/etc/artemis-users.properties", "a").write("%s = ENC(1024:%s:%s)\n" % (u, s.hex().upper(), h.hex().upper())) r = "/var/lib/artemis/etc/artemis-roles.properties" t = open(r).read().splitlines() t = [l + "," + u if l.startswith("amq = ") else l for l in t] open(r, "w").write("\n".join(t) + "\n") ' "$U"; unset P

To change the admin password, replace its hash and the credentials file the same way:

read -rsp 'New admin password: ' P; echo printf '%s' "$P" | sudo python3 -I -c ' import hashlib, os, re, sys p = sys.stdin.read(); s = os.urandom(32) h = hashlib.pbkdf2_hmac("sha1", p.encode(), s, 1024, 64) f = "/var/lib/artemis/etc/artemis-users.properties" t = re.sub(r"(?m)^admin = ENC\(.*\)$", lambda m: "admin = ENC(1024:%s:%s)" % (s.hex().upper(), h.hex().upper()), open(f).read()) open(f, "w").write(t) c = "/root/artemis-credentials.txt" open(c, "w").write(re.sub(r"(?m)^ARTEMIS_ADMIN_PASSWORD=.*$", lambda m: "ARTEMIS_ADMIN_PASSWORD=" + p, open(c).read())) '; unset P

The configuration check refuses to start the broker if any user has a plain-text password, so always store the hash.

artemis-selfcheck re-proves the whole appliance with this instance's credentials. For each protocol, it shows that an anonymous connection and a wrong password are refused with the broker's own error, and that the admin login sends and receives a message over TLS.

It also checks that the default cluster credentials and plaintext clients are refused. It then covers the console login, the management API, the redirect, refusal of other host names, cross-origin requests and WebSocket upgrades, the loopback-only console and the metadata block inside every service:

sudo artemis-selfcheck

Apache Artemis appliance self-check (broker <public-ip>:61617, console https://<public-ip>/console/) [ok] CORE anonymous connection refused (JMSSecurityException, AMQ229031) [ok] CORE wrong password refused (JMSSecurityException, AMQ229031) [ok] CORE over TLS: admin login with this instance's password sent and received a message on sac.selfcheck.core [ok] AMQP anonymous connection refused (JMSSecurityException, AMQ229031 amqp:unauthorized-access) [ok] AMQP wrong password refused (JMSSecuritySaslException, SASL PLAIN rejected) [ok] AMQP over TLS: admin login with this instance's password sent and received a message on sac.selfcheck.amqp [ok] OPENWIRE anonymous connection refused (JMSSecurityException, AMQ229031 (user name or password is invalid)) [ok] OPENWIRE wrong password refused (JMSSecurityException, AMQ229031 (user name or password is invalid)) [ok] OPENWIRE over TLS: admin login with this instance's password sent and received a message on sac.selfcheck.openwire [ok] CORE default cluster credentials (ACTIVEMQ.CLUSTER.ADMIN.USER / CHANGE ME!!) refused (JMSSecurityException, AMQ229031) [ok] a plaintext (non-TLS) CORE client cannot use port 61617 (JMSException) [ok] port 61617 presents this instance's certificate (/etc/artemis/broker.crt); TLS 1.1 refused [ok] HTTPS console page -> 200 [ok] Jolokia without a login -> 403, with a wrong password -> 403; wrong console login -> 403 [ok] console login with the per-instance password -> Secure session; Jolokia reports broker version 2.57.0 [ok] Jolokia with HTTP Basic + this instance's origin -> 200; without an Origin -> refused by Jolokia's strict check [ok] the console's same-origin Jolokia GET (Referer, no Origin) -> 200; a foreign Referer -> refused by Jolokia [ok] port 80 -> 301 https://<public-ip>/; unknown Host -> 444; CONNECT refused; cross-origin login/Jolokia -> 403; WebSocket -> 403; Hawtio proxy -> 404 [ok] console 8161 refuses the private address; no plaintext CORE/AMQP/MQTT/STOMP/HornetQ listener (61616/5672/1883/61613/5445) [ok] instance metadata refused inside the artemis and nginx cgroups (loopback control 200) SELFCHECK OK - TLS messaging (CORE, AMQP, OpenWire) with the per-instance login, console over HTTPS, origin guard, loopback-only console, metadata block verified.

The self-check creates three small queues named sac.selfcheck.* and leaves them empty. The metadata block is a systemd IPAddressDeny rule on each service. You can see it in effect:

for u in artemis nginx artemis-firstboot; do printf '%s: ' $u; systemctl show -p IPAddressDeny --value $u.service; done

artemis: fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 nginx: fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 artemis-firstboot: fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32

Because of this block, broker plugins cannot pick up the instance's IAM role credentials. Bridges, federation and broker connections to other hosts work normally.

The only listener is the tls acceptor in /var/lib/artemis/etc/broker.xml. To also accept MQTT or STOMP clients, add them to its protocols= list (for example protocols=CORE,AMQP,OPENWIRE,MQTT), keep sslEnabled=true, and restart the broker with sudo systemctl restart artemis. MQTT and STOMP clients then connect over TLS to port 61617 as well.

The configuration check refuses to start the broker with a listener on a public address that does not use TLS. A plaintext listener for local applications on the same instance is allowed on 127.0.0.1 only, for example <acceptor name="local">tcp://127.0.0.1:61616?protocols=CORE,AMQP</acceptor>.

sed -n '1,7p' /usr/share/doc/apache-artemis/BUILD-PROVENANCE.txt java -version 2>&1 | sed -n 1p

Apache Artemis 2.57.0 (formerly Apache ActiveMQ Artemis) - official ASF binary release (not rebuilt) source https://downloads.apache.org/artemis/artemis/2.57.0/apache-artemis-2.57.0-bin.tar.gz sha512 47d2193b4707bde8c856ee0f7ee623e87722559b8503aaef6ee015496499774a8c9b9492933cc0a52873e95dce73ff825222422996d2a8768a4936b015415e8c signature apache-artemis-2.57.0-bin.tar.gz.asc, VALIDSIG 28417C95E8906D108392822354A43F3254868410 (ASF KEYS) licence Apache License 2.0 (LICENSE sha256 7f0599bdd57251da388bf4556e0a05ac88c5129c8578daafbace5b5360233cf1; bundled third-party notices in LICENSE/NOTICE) runtime OpenJDK 21 (Ubuntu main, /usr/lib/jvm/java-21-openjdk-amd64) netty-handler 4.1.137.Final (CVE-2026-75595 fixed in 4.1.137) openjdk version "21.0.12.1" 2026-08-18

Path What it is

/var/lib/artemis/etc/broker.xml broker settings: acceptor, addresses, queues, security settings

/var/lib/artemis/etc/artemis-users.properties, artemis-roles.properties users (hashed passwords) and roles

/var/lib/artemis/data the message journal, bindings, paging and large messages

/var/lib/artemis/log/artemis.log the broker log (also journalctl -u artemis)

/root/artemis-credentials.txt URLs and admin password (root only)

/etc/artemis/broker.crt, /etc/artemis/tls/broker.pem the certificate clients trust; the broker's key and certificate

/etc/nginx/sites-available/sac-artemis the HTTPS front door of the console; certificate and key in /etc/nginx/ssl/

/opt/artemis/current the Artemis distribution and command line client

/usr/share/doc/apache-artemis/ LICENSE, NOTICE and BUILD-PROVENANCE.txt

• Back up /var/lib/artemis/etc (configuration and users), /etc/artemis, /etc/sac and /etc/nginx/ssl. To back up messages, stop the broker and copy /var/lib/artemis/data, or use EBS snapshots of the root volume.
• The journal lives on the root volume. The broker blocks producers when the disk is 90% full (max-disk-usage). Size the root volume for your backlog when you launch (Step 1), or grow it later with an EBS volume modification and sudo growpart /dev/nvme0n1 1 && sudo resize2fs /dev/nvme0n1p1.
• The broker runs with a Java heap of up to 2 GB (-Xmx2G in /var/lib/artemis/etc/artemis.profile). An m5.large is comfortable. For large backlogs or many connections, raise the heap and use a larger instance.
• Ubuntu security updates install automatically (unattended-upgrades), including the OpenJDK runtime. Artemis itself lives in /opt/artemis. To upgrade, launch the newer version from the listing and move your configuration and data across.

• Limit TCP 61617 in the security group to the networks your applications run in, and limit TCP 443 and TCP 22 to your admin network. The console can read, move and delete messages. Treat it as an administrative console, ideally reachable over a VPN or a private load balancer only.
• Give each application its own user with only the permissions it needs, and change the admin password if you share the credentials file (Step 10).
• Serve the broker under your own DNS name with a certificate from a trusted CA (Step 9), and have clients verify the host name.
• Keep TLS on every listener that is reachable from the network, and keep the console on 127.0.0.1.