2

We have some code that was connecting to a SQL 2008 R2 database on a different server using the Microsoft sqljdbc4.jar driver. It was running fine using Java 1.6u31 and we recently upgraded the system which necessitated a change to Java 1.7u17. Now the connection attempt hangs for a short period of times and throws the following.

Sep 24, 2014 11:53:04 AM com.microsoft.sqlserver.jdbc.TDSChannel enableSSL
INFO: java.security path: D:\Documentum\java64\1.7.0_17\jre\lib\security
Security providers: [RsaJsse version 6.0, JsafeJCE version 6.002, SUN version 1.7, SunRsaSign version 1.7, SunEC version 1.7, SunJSSE version 1.7, SunJCE version 1.7, SunJGSS version 1.7, SunSASL version 1.7, XMLDSig version 1.0, SunPCSC version 1.7, SunMSCAPI version 1.7]
SSLContext provider info: SSL-J 6.0 JSSE Provider supporting SSLv3, TLSv1, TLSv1.1, and TLSv1.2
SSLContext provider services:
[RsaJsse: SSLContext.TLS -> com.rsa.sslj.x.cr
  aliases: [SSLv3, SSL, TLSv1, TLSv1.1, TLSv1.2]
, RsaJsse: SSLContext.Default -> com.rsa.sslj.x.B
, RsaJsse: KeyManagerFactory.X509 -> com.rsa.sslj.x.y
  aliases: [SunX509, NewSunX509, IbmX509, NewIbmX509, RsaX509]
, RsaJsse: TrustManagerFactory.X509 -> com.rsa.sslj.x.bI
  aliases: [SunX509, IbmX509, X.509, RsaX509]
, RsaJsse: TrustManagerFactory.PKIX -> com.rsa.sslj.x.cI
  aliases: [SunPKIX, IbmPKIX]
, RsaJsse: TrustManagerFactory.PKIX-SuiteB -> com.rsa.sslj.x.aj
, RsaJsse: TrustManagerFactory.PKIX-SuiteBTLS -> com.rsa.sslj.x.D
]
java.ext.dirs: D:\Documentum\java64\1.7.0_17\jre\lib\ext;C:\Windows\Sun\Java\lib\ext
Exception in thread "main" com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "Connection reset".
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnecQtion.java:1352)
    at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1533)
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:1042)
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:817)
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:700)
    at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:842)
    at java.sql.DriverManager.getConnection(DriverManager.java:579)
    at java.sql.DriverManager.getConnection(DriverManager.java:221)
    at com.test.TestDatabaseConnection.getDatabaseConnection(TestDatabaseConnection.java:56)
    at com.test.TestDatabaseConnection.main(TestDatabaseConnection.java:25)
Caused by: java.io.IOException: Connection reset
    at com.microsoft.sqlserver.jdbc.TDSChannel$SSLHandshakeInputStream.readInternal(IOBuffer.java:673)
    at com.microsoft.sqlserver.jdbc.TDSChannel$SSLHandshakeInputStream.read(IOBuffer.java:656)
    at com.microsoft.sqlserver.jdbc.TDSChannel$ProxyInputStream.readInternal(IOBuffer.java:851)
    at com.microsoft.sqlserver.jdbc.TDSChannel$ProxyInputStream.read(IOBuffer.java:839)
    at com.rsa.sslj.x.aP.c(Unknown Source)
    at com.rsa.sslj.x.aP.a(Unknown Source)
    at com.rsa.sslj.x.aP.a(Unknown Source)
    at com.rsa.sslj.x.aP.h(Unknown Source)
    at com.rsa.sslj.x.cy.startHandshake(Unknown Source)
    at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1483)
    ... 8 more

Running just the database connect code in Eclipse I can reproduce the error with a clean copy of 1.7u17. Running the same with 1.6u31 instead works fine. We have to stick to this version of Java due to a 3rd party application this code runs inside.

static Connection getDatabaseConnection() throws Exception{

Connection conn = null;

final String DRIVER = "jdbc:sqlserver";
String server = "<server123>";
String port = "1433"; 
String sid = "<db123>"; 
String user = "<user123>"; 
String pass = "<password123>";

String url = "jdbc:sqlserver://" +
server + ":" + port + ";" +
"databaseName=" + sid +
";user=" + user +
";password=" + pass + ";";

Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");

conn = DriverManager.getConnection(url, user, pass);

return conn;

}

Matthew
  • 23
  • 1
  • 4
  • Have you tried with the default Sun/Oracle JSSE instead of RSA/Jsafe? (jTDS might also be of interest.) – Bruno Sep 25 '14 at 19:57
  • In isolation I was able to get the code to work with 1.7. It appears the 1.7 jdk run inside the Documentum method server has a modified java.security file in the newest version. com.rsa.jsse.JsseProvider is listed first there while a clean jdk puts sun.security.provider.sun in the first slot. – Matthew Sep 25 '14 at 21:22
  • Since I can't modify the jdk here I found mention of using Security.addProvider. Specifying Security.addProvider( new com.security.provider.sun()) had no effect. Trying Security.insertProviderAt(new com.security.provider.sun(), 1) still throws the same error mentioning RsaJsse – Matthew Sep 25 '14 at 21:36
  • It's likely that the Sun provider is already installed, just further down the list, and the doc for `insertProviderAt` says "*A provider cannot be added if it is already installed.*". Documentation for RsaJsse and Jsafe is hard to find, it's not directly related, but [this document](http://docs.oracle.com/middleware/1213/wls/SECMG/standards.htm#A1124197) seems to suggest that a version of WebLogic running on Java 7 needs JsafeJCE 6.1, whereas you have version 6.0. This 6.0/6.1 difference might have something to do with Java 6/Java 7 incompatibilities. – Bruno Sep 25 '14 at 22:02
  • Yea, turns out two RSA providers were inserted at the top of the list in slots 1 and 2. So doing two Security.removeProvider(Security.getProviders()[0].getName()) returned the list to the jdk default and the connection worked normally. So it looks like the com.rsa.jsee.JsseProvider doesn't talk well with MSSql 2008 R2. Thanks! – Matthew Sep 25 '14 at 22:23
  • You may find this helpful: http://stackoverflow.com/questions/32766114/sql-server-jdbc-error-on-java-8-the-driver-could-not-establish-a-secure-connect – 2Aguy Sep 24 '15 at 16:19

0 Answers0