In order for a connection to be capable of decrypting received encrypted messages, it must be provided with a key store which contains the X509 certificates and associated Private Keys of the identities on behalf of which it will be able to decrypt. The details of the key store are supplied in the connection URL. The location and password for this must be specified using the encryption_key_store and encryption_trust_store_password options respectively. Such a connection URL might look somthing like:

amqp://username:password@clientid/test?brokerlist='tcp://localhost:5672?encryption_key_store='/home/qpid/identities.jks'&encryption_key_store_password='password''