Contact Us 1-800-596-4880
  1. Homepage
  2. Mule Runtime (3.7)
  3. Reference
  4. Transports Reference

  5. SSL and TLS Transports Reference

SSL and TLS Transports Reference

Mule Runtime Engine versions 3.5, 3.6, and 3.7 reached End of Life on or before January 25, 2020. For more information, contact your Customer Success Manager to determine how you can migrate to the latest Mule version.
This page refers to using SSL and TLS together with the old endpoint based HTTP connector. For using TLS with the new HTTP Connector and the Web Service Consumer connector, see TLS Configuration.

The following Mule transports provide access to TCP connections:

  • The TCP Transport, which uses the basic TCP transport.

  • The Secure Sockets Layer (SSL) and Transport Layer Security (TLS) transports use TCP with socket-level security.

Other than the type of socket used, these transports all behave quite similarly.

SSL and TLS are alternative names for the same transport. For simplicity, this page refers to the transport as only SSL, but everything here also applies to TLS.

The SSL transport allows sending or receiving messages over SSL connections. SSL is a layer over IP and implements many other reliable protocols such as HTTPS and SMTPS. However, you may want to use the SSL transport directly if you require a specific protocol for reading the message payload that is not supported by one of these higher level protocols. This is often the case when communicating with legacy or native system applications that don’t support web services.

Namespace and Syntax

XML namespace:

xmlns:ssl="http://www.mulesoft.org/schema/mule/ssl"
xmlns:tls="http://www.mulesoft.org/schema/mule/tls"

XML schema location:

http://www.mulesoft.org/schema/mule/ssl http://www.mulesoft.org/schema/mule/ssl/3.7/mule-ssl.xsd
http://www.mulesoft.org/schema/mule/tls http://www.mulesoft.org/schema/mule/tls/3.7/mule-tls.xsd

Connector syntax:

<ssl:connector name="tcpConnector" receiveBufferSize="1024" receiveBacklog="50" sendTcpNoDelay="false"
                reuseAddress="true" clientSoTimeout="0" serverSoTimeout="0" socketSoLinger="0"
                keepSendSocketOpen="false" keepAlive="true" dispatcherFactory-ref="dispatcherBean">
    <tcp:PROTOCOL-TYPE/>
    <ssl:client path="clientKeystore" storePassword="swordfish" class="JKS"/>
    <ssl:key-store path="keystore" class="JKS" keyPassword="swordfish" storePassword="sturgeon" algorithm="SHA"/>
    <ssl:server class="JKS" algorithm="SHA" explicitOnly="false" requireClientAuthentication = "false" />
    <ssl:protocol-handler type="com.mycompany.protocols"/>
</ssl:connector>

Protocol Types

PROTOCOL-TYPE defines how messages in Mule are reconstituted from the data packets. The protocol types are:

<tcp:direct-protocol payloadOnly="true" rethrowExceptionOnRead="true"/>
<tcp:eof-protocol payloadOnly="true" rethrowExceptionOnRead="true"/>
<tcp:length-protocol payloadOnly="true" maxMessageLength="1024" rethrowExceptionOnRead="true"/>
<tcp:xml-protocol rethrowExceptionOnRead="true"/>
<tcp:xml-eof-protocol rethrowExceptionOnRead="true"/>
<tcp:streaming-protocol rethrowExceptionOnRead="true"/>
<tcp:safe-protocol payloadOnly="true" maxMessageLength="1024" rethrowExceptionOnRead="true"/>
<tcp:custom-class-loading-protocol classLoader-ref="classLoaderBean" payloadOnly="true" maxMessageLength="1024" rethrowExceptionOnRead="true"/>
<tcp:custom-protocol class="com.mycompany.MyProtocol" rethrowExceptionOnRead="true"/>

Endpoint syntax:
You can define your endpoints 2 different ways:

  1. Prefixed endpoint:

    <ssl:inbound-endpoint host="localhost" port="65433"/>

  2. Non-prefixed URI:

    <inbound-endpoint address="ssl://localhost:65433"/>

See the sections below for more information.

Considerations

SSL is one of the standard communication protocols used on the Internet, and supports secure communication both across the internet and within a local area network. The Mule SSL transport uses native Java socket support, adding no communication overhead to the classes in java.net, while allowing many of the advanced features of SSL programming to be specified in the Mule configuration rather than coded in Java.

Use this transport when communicating using low-level SSL connections. To determine when this is appropriate, you can use the following decision tree:

  • Communicating with an external service that uses low-level unsecured TCP connections? If so, use the TCP protocol.

  • Are you communicating with a flow always located in the same Mule application instance? If so, consider using the VM transport.

  • Is it important that messages be persisted until they can be processed? If so, consider using a persistent transport like JMS or File.

  • Are there advantages to a higher-level protocol built on top of TCP, for instance, the request-response features of HTTP, or the store-and-forward features of Email? If so, use the transport for that protocol instead.

  • Is performance the primary concern and it is not important that messages be delivered in the proper order or that the sender is notified if any are lost? If so, use the lighter-weight UDP transport instead.

  • Should messages be secured? If so, use the SSL transport.

As shown in the examples below, the SSL transport can be used to

The use of SSL with Java is described in detail in the JSSE Reference Guide. In particular, it describes the keystores used by SSL, how the certificates they contain are used, and how to create and maintain them.

Features

The SSL module allows a Mule application both to send and receive messages over SSL connections, and to declaratively customize the following features of SSL (with the standard name for each feature, where applicable):

  • The timeout for blocking socket operations. This can be declared separately for client and server operations. (SO_TIMEOUT)

  • How long to keep the socket open to allow pending sends to complete. (SO_LINGER)

  • Whether to send available data immediately rather than buffering it. (TCP_NODELAY)

  • Whether to reuse a socket address immediately (SO_REUSEADDR)

  • Whether to use keep-alive to detect when a remote system is no longer reachable (SO_KEEPALIVE).

  • The size in bytes of the network buffer (SO_SNDBUF).

  • The number of pending connection requests to allow.

  • Whether to close a client socket after sending a message.

Protocol Tables

In addition, since TCP and SSL are stream-oriented and Mule is message-oriented, some application protocol is needed to to define where each message begins and ends within the stream. The table below lists the built-in protocols, describing:

  • The XML tag used to specify them

  • Any XML attributes

  • How it defines a message when reading

  • Any processing it does while writing a message

XML tag Notes

<tcp:custom-class-loading-protocol>

Like the length protocol, but specifies a classloader used to deserialize objects.

Options: rethrowExceptionOnRead, payloadOnly, maxMessageLength, classLoader-ref
Read: Expects the message to begin with a 4-byte length (in DataOutput.writeInt() format).
Write: Precedes the message with a 4-byte length (in DataOutput.writeInt() format).

<tcp:custom-protocol>

Allows user-written protocols, for instance, to match existing TCP services.

Options: rethrowExceptionOnRead, class, ref
Read: varies
Write: varies

<tcp:direct-protocol>

There are no explicit message boundaries.

Options: rethrowExceptionOnRead, payloadOnly
Read: All currently available bytes
Write: none

<tcp:eof-protocol>

EOF Protocol

Options: rethrowExceptionOnRead, payloadOnly
Read: All bytes sent until the socket is closed.
Write: none

<tcp:length-protocol>

Length Protocol

Options: rethrowExceptionOnRead, payloadOnly, maxMessageLength
Read: Expects the message to begin with a 4-byte length (in DataOutput.writeInt() format)
Write: Precedes the message with a 4-byte length (in DataOutput.writeInt() format)

<tcp:safe-protocol>

Somewhat safer than the length protocol because of the extra check. This is the default if no protocol is specified. Expects the message to begin with the string "You are using SafeProtocol" followed by a 4-byte length (in DataOutput.writeInt() format).

Options: rethrowExceptionOnRead, payloadOnly, maxMessageLength
Read: Expects the message to be preceded by the string "You are using SafeProtocol" followed by a 4-byte length (in DataOutput.writeInt() format).
Write: Precedes the message with the string "You are using SafeProtocol" followed by a 4-byte length (in DataOutput.writeInt() format).

<tcp:streaming-protocol

Streaming Protocol

Options: rethrowExceptionOnRead
Read: All bytes sent until the socket is closed+ Write: none

<tcp:xml-protocol>

The XML declaration must occur in all messages.

Options: rethrowExceptionOnRead
Read: A message is an XML document that begins with an XML declaration.
Write: none

<tcp:xml-eof-protocol>

The XML declaration must occur in all messages.

Options: rethrowExceptionOnRead
Read: A message is an XML document that begins with an XML declaration, or whatever remains at EOF.
Write: none
Table 1. Protocol Attributes
Name Notes

class

See TCP Transport Reference for an example of writing a custom protocol

Values: The name of the class that implements the custom protocol.
Default Value: none

classLoader-ref

A message longer than the maximum causes an exception to be thrown.

Values: A reference to a Spring bean that contains the custom classloader.
Default Value: maxMessageLength

payloadOnly

Protocols that don’t support this attribute always process payloads.

Values: true
Default Value: If true, only the Mule message payload is sent or received. If false, the entire Mule message is sent or received.

ref

A reference to a Spring bean that implements the custom protocol.

Values: none
Default Value: none

rethrowExceptionOnRead

Setting this to "false" avoids logging stack traces when the remote socket is closed unexpectedly.

Values: Whether to rethrow exception that occur trying to read from the socket+ Default Value: false

Usage

SSL endpoints can be used in one of two ways:

  • To create an SSL server that accepts incoming connections, declare an inbound ssl endpoint with an ssl:connector. This creates an SSL server socket that reads requests from and optionally writes responses to client sockets.

  • To write to an SSL server, create an outbound endpoint with an ssl:connector. This creates an SSL client socket that writes requests to and optionally reads responses from a server socket.

To use SSL endpoints, follow the following steps:

  1. Add the MULE SSL namespace to your configuration:

    • Define the SSL prefix using xmlns:ssl="http://www.mulesoft.org/schema/mule/ssl"

    • Define the schema location with http://www.mulesoft.org/schema/mule/ssl http://www.mulesoft.org/schema/mule/ssl/current/mule-ssl.xsd

  2. Define one or more connectors for SSL endpoints.

Create an SSL Server

To act as a server that listens for and accepts SSL connections from clients, create an SSL connector that inbound endpoints use:

<ssl:connector name="sslConnector"/>

Send Messages to an SSL Server

To send messages on an SSL connection, create a simple TCP connector that outbound endpoints use:

<tcp:connector name="sslConnector"/>

  1. Configure the features of each connector that was created.

    • Begin by choosing the protocol to be used for each message that is sent or received.

    • For each polling connector, choose how often it polls and how long it waits for the connection to complete.

    • Consider the other connector options as well. For instance, if it is important to detect when the remote system becomes unreachable, set keepAlive to true.

  2. Create SSL endpoints.

    • Messages are received on inbound endpoints.

    • Messages are sent to outbound endpoints.

    • Both kinds of endpoints are identified by a host name and a port.

By default, SSL endpoints use the request-response exchange pattern, but they can be explicitly configured as one-way. The decision should be straightforward:

Message Flow Connector type Endpoint type Exchange Pattern

Mule receives messages from clients but sends no response

ssl:connector

inbound

one-way

Mule receives messages from clients and sends response

ssl:connector

inbound

request-response

Mule sends messages to a server but receives no response

ssl:connector

outbound

one-way

Mule sends messages to a server and receives responses

ssl:connector

outbound

request-response

Example Configurations

SSL Connector in a Flow 
<ssl:connector name="serverConnector" payloadOnly="false">
    <tcp:eof-protocol /> ❹
    <ssl:client path="clientKeystore"/>
    <ssl:key-store path="serverKeystore"/>
</tcp:connector> ❶


<flow name="echo">
    <ssl:inbound-endpoint host="localhost" port="4444" > ❷
    <ssl:outbound-endpoint host="remote" port="5555" /> ❸
</flow>

This shows how to create an SSL server in Mule. The connector at ❶ defines that a server socket is created that accepts connections from clients. Complete mule messages are read from the connection (direct protocol) becomes the payload of a Mule message (since payload only is false). The endpoint at ❷ applies these definitions to create a server at port 4444 on the local host. The messages read from there are then sent to a remote ssl endpoint at ❸.
The flow version uses the eof protocol (❹), so that every byte sent on the connection is part of the same Mule message. Note that both connectors specify separate keystores to be used by the client (outbound) and server (inbound) endpoints.

Configuration Options

Table 2. SSL Connector attributes
Name Description Default

clientSoTimeout

Amount of time (in milliseconds) to wait for data to be available when reading from a TCP server socket

system default

keepAlive

Whether to send keep-alive messages to detect when the remote socket becomes unreachable

false

keepSendSocketOpen

Whether to keep the the socket open after sending a message

false

receiveBacklog

The number of connection attempts that can be outstanding

system default

receiveBufferSize

This is the size of the network buffer used to receive messages. In most cases, there is no need to set this, since the system default is sufficient

system default

reuseAddress

Whether to reuse a socket address that’s currently in a TIMED_WAIT state. This avoids triggering the error that the socket is unavailable

true

sendBufferSize

The size of the network send buffer

system default

sendTcpNoDelay

Whether to send data as soon as its available, rather than waiting for more to arrive to economize on the number of packets sent

false

socketSoLinger

How long (in milliseconds) to wait for the socket to close so that all pending data is flused

system default

serverSoTimeout

Amount of time (in milliseconds) to wait for data to be available when reading from a client socket

system default
Table 3. SSL connector child elements and their attributes:
Name Description

client

Configures the client keystore
Table 4. Client 's attributes:
Name Description

path

Location of the client keystore

storePassword

Password for the client keystore

class

Type of keystore used
Name Description

key-store

Configures the server keystore
Table 5. key-store 's attributes:
Name Description

path

Location of the server keystore

storePassword

Password for the server keystore

class

Type of server keystore used

keyPassword

Password for the private key

algorithm

Algorithm used by the server keystore
Name Description

server

Configures the server trust store
Table 6. server 's attributes:
Name Description

class

Type of keystore used for the trust store

algorithm

Algorithm used by the trust stor

factory-ref

TrustManagerFactory configured as a Spring bean

explicitOnly

If true, do not use the server keystore when a trust store is unavailable. Defaults to false.

requireClientAuthentication

If true, all clients must authenticate themselves when communicating with a Mule SSL server endpoint. Defaults to false.
Name Description

protocol-handler

Defines a list of Java packages in which protocol handlers are found
Table 7. protocol-handler 's attributes:
Name Description

property

The list of packages.

For more details about creating protocol handlers in Java, see http://java.sun.com/developer/onlineTraining/protocolhandlers .

Configuration Reference

Element Listing

SSL Transport

The SSL transport can be used for secure socket communication using SSL or TLS. The Javadoc for this transport can be found here.

Connector

Connects Mule to an SSL socket to send or receive data via the network.

Inbound endpoint

Table 8. Attributes of <inbound-endpoint…​>
Name Type Required Default

host

string

no

port

port number

no

No Child Elements of <inbound-endpoint…​>

Outbound endpoint

Table 9. Attributes of <outbound-endpoint…​>
Name Type Required Default

host

string

no

port

port number

no

No Child Elements of <outbound-endpoint…​>

Endpoint

Table 10. Attributes of <endpoint…​>
Name Type Required Default

host

string

no

port

port number

no

No Child Elements of <endpoint…​>

Schema

The schema for the SSL module appears here.

Javadoc API Reference

Reference the SSL Javadoc for this module.

Maven

The SSLModule can be included with the following dependency:

<dependency>
  <groupId>org.mule.transports</groupId>
  <artifactId>mule-transport-ssl</artifactId>
  <version>3.7.0</version>
</dependency>

Extending This Transport

When using TCP to communicate with an external program, it may be necessary to write a custom Mule protocol. The first step is to get a complete description of how the external program delimits messages within the TCP stream. The next is to implement the protocol as a Java class.

  • All protocols must implement the interface org.mule.transport.tcp.TcpProtocol, which contains three methods:

    • Object read(InputStream is) reads a message from the TCP socket

    • write(OutputStream os, Object data) writes a message to the TCP socket

    • ResponseOutputStream createResponse(Socket socket) creates a stream to which a response can be written.

  • Protocols which process byte-streams rather than serialized Mule messages can inherit much useful infrastructure by subclassing `org.mule.transport.tcp.protocols.AbstractByteProtocol`This class

    • implements createResponse

    • handles converting messages to byte arrays, allowing subclasses to implement only the simpler method writeByteArray(OutputStream os, byte[] data)

    • provides methods safeRead(InputStream is, byte[] buffer) and safeRead(InputStream is, byte[] buffer, int size) that handle the situation where data is not currently available when doing non-blocking reads from the TCP socket

Suppose we want to communicate with a server that has a simple protocol: all messages are terminated by >>>. The protocol class would look like this:

package org.mule.transport.tcp.integration;

import org.mule.transport.tcp.protocols.AbstractByteProtocol;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;

public class CustomByteProtocol extends AbstractByteProtocol
{

    /**
     * Create a CustomByteProtocol object.
     */
    public CustomByteProtocol()
    {
        super(false); // This protocol does not support streaming.
    }

    /**
     * Write the message's bytes to the socket,
     * then terminate each message with '>>>'.
     */
    @Override
    protected void writeByteArray(OutputStream os, byte[] data) throws IOException
    {
        super.writeByteArray(os, data);
        os.write('>');
        os.write('>');
        os.write('>');
    }

    /**
     * Read bytes until we see '>>>', which ends the message
     */
    public Object read(InputStream is) throws IOException
    {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        int count = 0;
        byte read[] = new byte[1];

        while (true)
        {
            // If no bytes are currently available, safeRead()
            //  waits until bytes arrive
            if (safeRead(is, read) < 0)
            {
                // We've reached EOF.  Return null, so that our
                // caller knows there are no
                // remaining messages
                return null;
            }
            byte b = read[0];
            if (b == '>')
            {
                count++;
                if (count == 3)
                {
                    return baos.toByteArray();
                }
            }
            else
            {
                for (int i = 0; i < count; i++)
                {
                    baos.write('>');
                }
                count = 0;
                baos.write(b);
            }
        }
    }
}

Notes

TCP and SSL are very low-level transports, so the usual tools for debugging their use, for instance, logging messages as they arrive, might not be sufficient. Once messages are being sent and received successfully, things are largely working. It may be necessary to use software (or hardware) than can track messages at the packet level, particularly when a custom protocol is being used. Alternatively, you can debug by temporarily using the direct protocol on all inbound endpoints, since it accepts (and you can then log) bytes as they are received.