Check MS SQL connection Encryption strength/length (for JDBC)

0
votes

When connecting with Java (IBM JRE 1.6 or 1.7) and MS JDBC Driver 4.0.2206.100 the login is for sure or entire connection is encrypted (SSL/TLS or TDS or ??). (Default of driver encrypt = false or blank info here; MS JDBC blog info here)

Some instance working fine some give error "RSA premaster secret error" (entire Stack Trace below). All MS SQL instance have no SSL enabled.

When using the IBM Java Cryptography Extension (JCE) Unlimited Strength (US export restrictions) I can also connect to the instance which gave me before the RSA secret error before.

It seems that the difference of MS SQL instances is the "Log on as" user (different Domain user)

Question 1: How do I find details about the encryption/certificate (length/strength/...)? On MS SQL without SSL enabled how to identify what cert is used for the JDBC connection

  • Tested with Squirrel and IBM tool(both with IBM Java).
  • Squirrel with Oracle JRE 1.8 works right away without using unlimited strength JCE
  • DB is MS SQL 2012 SP2 if that matters.

Full Stack trace of error (IBM JRE not using unlimited strength JCE)

000000c0 DSConfigurati W   DSRA8201W: DataSource Configuration: DSRA8040I: Failed to connect to the DataSource null.  Encountered java.sql.SQLException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "RSA premaster secret error". ClientConnectionId:a5af5544-1768-49bc-b91d-87169cd06306 DSRA0010E: SQL State = 08S01, Error Code = 0.
java.sql.SQLException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "RSA premaster secret error". ClientConnectionId:a5af5544-1768-49bc-b91d-87169cd06306 DSRA0010E: SQL State = 08S01, Error Code = 0
                 at com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnection.java:1667)
                 at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1668)
                 at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:1323)
                 at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:991)
                 at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:827)
                 at com.microsoft.sqlserver.jdbc.SQLServerDataSource.getConnectionInternal(SQLServerDataSource.java:621)
                 at com.microsoft.sqlserver.jdbc.SQLServerPooledConnection.createNewConnection(SQLServerPooledConnection.java:60)
                 at com.microsoft.sqlserver.jdbc.SQLServerPooledConnection.<init>(SQLServerPooledConnection.java:42)
                 at com.microsoft.sqlserver.jdbc.SQLServerConnectionPoolDataSource.getPooledConnection(SQLServerConnectionPoolDataSource.java:34)
                 at com.ibm.ws.rsadapter.DSConfigHelper$1.run(DSConfigHelper.java:1273)
                 at com.ibm.ws.security.auth.ContextManagerImpl.runAs(ContextManagerImpl.java:5477)
                 at com.ibm.ws.security.auth.ContextManagerImpl.runAsSystem(ContextManagerImpl.java:5603)
                 at com.ibm.ws.security.core.SecurityContext.runAsSystem(SecurityContext.java:255)
                 at com.ibm.ws.rsadapter.spi.ServerFunction$6.run(ServerFunction.java:567)
                 at com.ibm.ws.security.util.AccessController.doPrivileged(AccessController.java:118)
                 at com.ibm.ws.rsadapter.DSConfigHelper.getPooledConnection(DSConfigHelper.java:1288)
                 at com.ibm.ws.rsadapter.DSConfigHelper.getPooledConnection(DSConfigHelper.java:1196)
                 at com.ibm.ws.rsadapter.DSConfigurationHelper.getConnectionFromDSOrPooledDS(DSConfigurationHelper.java:2075)
                 at com.ibm.ws.rsadapter.DSConfigurationHelper.getConnectionFromDSOrPooledDS(DSConfigurationHelper.java:1951)
                 at com.ibm.ws.rsadapter.DSConfigurationHelper.testConnectionToDataSource(DSConfigurationHelper.java:1763)
                 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
                 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:60)
                 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:37)
                 at java.lang.reflect.Method.invoke(Method.java:611)
                 at com.ibm.ws.management.DataSourceConfigHelperMBean.testConnectionToDataSource(DataSourceConfigHelperMBean.java:330)
                 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
                 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:60)
                 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:37)
                 at java.lang.reflect.Method.invoke(Method.java:611)
                 at sun.reflect.misc.Trampoline.invoke(MethodUtil.java:69)
                 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
                 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:60)
                 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:37)
                 at java.lang.reflect.Method.invoke(Method.java:611)
                 at sun.reflect.misc.MethodUtil.invoke(MethodUtil.java:272)
                 at javax.management.modelmbean.RequiredModelMBean$4.run(RequiredModelMBean.java:1152)
                 at java.security.AccessController.doPrivileged(AccessController.java:388)
                 at com.ibm.oti.security.CheckedAccessControlContext.securityCheck(CheckedAccessControlContext.java:30)
                 at sun.misc.JavaSecurityAccessWrapper.doIntersectionPrivilege(JavaSecurityAccessWrapper.java:41)
                 at javax.management.modelmbean.RequiredModelMBean.invokeMethod(RequiredModelMBean.java:1146)
                 at javax.management.modelmbean.RequiredModelMBean.invoke(RequiredModelMBean.java:999)
                 at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:847)
                 at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:783)
                 at com.ibm.ws.management.AdminServiceImpl$1.run(AdminServiceImpl.java:1350)
                 at com.ibm.ws.security.util.AccessController.doPrivileged(AccessController.java:118)
                 at com.ibm.ws.management.AdminServiceImpl.invoke(AdminServiceImpl.java:1243)
                 at com.ibm.ws.management.connector.AdminServiceDelegator.invoke(AdminServiceDelegator.java:181)
                 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
                 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:60)
                 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:37)
                 at java.lang.reflect.Method.invoke(Method.java:611)
                 at com.ibm.ws.management.connector.soap.SOAPConnector.invoke(SOAPConnector.java:488)
                 at com.ibm.ws.management.connector.soap.SOAPConnector.service(SOAPConnector.java:322)
                 at com.ibm.ws.management.connector.soap.SOAPConnection.handleRequest(SOAPConnection.java:65)
                 at com.ibm.ws.http.HttpConnection.readAndHandleRequest(HttpConnection.java:733)
                 at com.ibm.ws.http.HttpConnection.run(HttpConnection.java:522)
                 at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1881)
Caused by: javax.net.ssl.SSLKeyException: RSA premaster secret error
                 at com.ibm.jsse2.kb.<init>(kb.java:86)
                 at com.ibm.jsse2.mb.a(mb.java:419)
                 at com.ibm.jsse2.mb.a(mb.java:71)
                 at com.ibm.jsse2.lb.t(lb.java:241)
                 at com.ibm.jsse2.lb.a(lb.java:3)
                 at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:855)
                 at com.ibm.jsse2.SSLSocketImpl.h(SSLSocketImpl.java:320)
                 at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:676)
                 at com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:620)
                 at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1618)
                 ... 55 more
Caused by: java.security.InvalidKeyException: Illegal key size or default parameters
                 at javax.crypto.Cipher.a(Unknown Source)
                 at javax.crypto.Cipher.a(Unknown Source)
                 at javax.crypto.Cipher.a(Unknown Source)
                 at javax.crypto.Cipher.init(Unknown Source)
                 at com.ibm.jsse2.kb.<init>(kb.java:115)
                 ... 64 more

============== Update: ==============

SQL locates/pick cert based on the name (see this MS support link from Sep 12, 2008)

SQL Server looks at the certificate store to find a certificate with the same name as the Fully Qualified Domain Name System (FQDN) of the SQL Server computer name

so if server has cert with matching name it will try to use it. If that cert using stronger enc than supported by the JRE/JDK you will get the above error message

Also check this reg key (modify MSSQL11.MSSQLSERVER part for your instance/version)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQLServer\SuperSocketNetLib

here PS to check

Get-ItemProperty "hklm:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQLServer\SuperSocketNetLib"
1
javasql-serverencryptionjdbc
Hi Tilo, Did you able to solve this problem? - Nikhil
Hi, Nikhil, no idea. I think it boils down to my second comment below: "How do I check what cert SQL is using if NO cert is specifically selected under Protocols" - Tilo

1 Answers

0
votes

I would suggest running your tests with -Djavax.net.debug=all if this option works for IBM JDK. If not, try to find a similar option for IBM JDK. As a last resort use network packet sniffer.

This way you can get an idea who is complaining: the SQL server or the JDK running you client.

I would also try to run the same test under Oracle JDK if possible or under OpenJDK. This way you can pinpoint the cause of the problem.