JDBC无法与SQL Server建立SSL连接（Domino Java Agent FP 9）

Posted 2021-04-17

我有一个在Domino服务器上运行的Java代理。它在版本Domino 9.0.1 FP7上运行良好。 MS Windows服务器是2003.等待SQL Server版本。

现在我们将Domino服务器升级到9.0.1 FP9。 JVM从1.6升到1.8。

我假设此异常错误是由JVM或Java策略引起的，因为我将JDBC驱动程序从4.2升级到6.2.2，试图修复此错误但没有成功（相同的错误）。

连接字符串原始（JDBC驱动程序... jvm / lib / ext / mssql-jdbc-6.2.2.jre8.jar）

String driver = "com.microsoft.sqlserver.jdbc.SQLServerDriver";
            String url = "jdbc:sqlserver://SERVER";

连接字符串相同结果（JDBC驱动程序... jvm / lib / ext / mssql-jdbc-6.2.2.jre8.jar） - 添加了encrypt = false。

String driver = "com.microsoft.sqlserver.jdbc.SQLServerDriver";
            String url = "jdbc:sqlserver://SERVER:1433;encrypt=false;";

例外

com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "SQL Server did not return a response. The connection has been closed. ClientConnectionId:e8a3a2c4-d9a9-4f82-a63f-967cae0c29f0".
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnection.java:2435)
    at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1816)
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:2022)
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:1687)
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:1528)
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:866)
    at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:569)
    at java.sql.DriverManager.getConnection(DriverManager.java:675)
    at java.sql.DriverManager.getConnection(DriverManager.java:258)
    at OrderTrackOrders.NotesMain(Unknown Source)
    at lotus.domino.AgentBase.runNotes(Unknown Source)
    at lotus.domino.NotesThread.run(Unknown Source)
Caused by: java.io.IOException: SQL Server did not return a response. The connection has been closed. ClientConnectionId:e8a3a2c4-d9a9-4f82-a63f-967cae0c29f0
    at com.microsoft.sqlserver.jdbc.TDSChannel$SSLHandshakeInputStream.ensureSSLPayload(IOBuffer.java:774)
    at com.microsoft.sqlserver.jdbc.TDSChannel$SSLHandshakeInputStream.readInternal(IOBuffer.java:830)
    at com.microsoft.sqlserver.jdbc.TDSChannel$SSLHandshakeInputStream.read(IOBuffer.java:821)
    at com.microsoft.sqlserver.jdbc.TDSChannel$ProxyInputStream.readInternal(IOBuffer.java:1003)
    at com.microsoft.sqlserver.jdbc.TDSChannel$ProxyInputStream.read(IOBuffer.java:991)
    at com.ibm.jsse2.b.a(b.java:272)
    at com.ibm.jsse2.b.a(b.java:148)
    at com.ibm.jsse2.at.a(at.java:19)
    at com.ibm.jsse2.at.i(at.java:627)
    at com.ibm.jsse2.at.a(at.java:689)
    at com.ibm.jsse2.at.startHandshake(at.java:432)
    at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1753)
    ... 10 more

答案

在Domino FeaturePack 9之前，这个代理在FP6和FP8上运行良好。

当连接到在Windows 2003服务器上运行的MS SQL服务器时，这是与FP9 java.security文件中禁用的TLS安全性密码相关的安全问题。

解决方案是在java.security文件中进行此更改'Domino Program Dir / jvm / lib / security / java.security'更改这两行以删除3DES_EDE_CBC，DESede From：

jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768, 3DES_EDE_CBC, DESede,  EC keySize < 224

至：

jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768, EC keySize < 224 

Feature Pack 9对服务器上Domino程序目录中的java.security文件进行了以下更改：Domino Program Dir / jvm / lib / security / java.security

在FP9之前更改1：

jdk.certpath.disabledAlgorithms=MD2, MD5, RSA keySize < 1024 

在FP9中更新：

jdk.certpath.disabledAlgorithms=MD2, MD5, RSA keySize < 1024,  
    DSA keySize < 1024, EC keySize < 224 

在FP9之前更改2：jdk.jar.disabledAlgorithms=MD2, RSA keySize < 1024在FP9中更新：jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024

在FP9之前更改3：jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768在FP9中更新：

jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768, 3DES_EDE_CBC, DESede,  
    EC keySize < 224 

更改4（以下条目在FP9中是新的）

jdk.xml.dsig.secureValidationPolicy= 
disallowAlg http://www.w3.org/TR/1999/REC-xslt-19991116, 
disallowAlg http://www.w3.org/2001/04/xmldsig-more#rsa-md5, 
disallowAlg http://www.w3.org/2001/04/xmldsig-more#hmac-md5, 
disallowAlg http://www.w3.org/2001/04/xmldsig-more#md5, 
maxTransforms 5, 
maxReferences 30, 
disallowReferenceUriSchemes file http https, 
minKeySize RSA 1024, 
minKeySize DSA 1024, 
noDuplicateIds, 
noRetrievalMethodLoops 

sun.rmi.registry.registryFilter=javax.rmi.CORBA.Stub 

另一答案

查看java.security，尝试评论已禁用的密码（我现在无法获取确切的属性，搜索SSL），或者这个https://blogs.msdn.microsoft.com/dataaccesstechnologies/2016/11/30/intermittent-jdbc-connectivity-issue-the-driver-could-not-establish-a-secure-connection-to-sql-server-by-using-secure-sockets-layer-ssl-encryption-error-sql-server-returned-an-incomplete-respons/

真正的解决方案是使用openssl测试1433并检查应该使用哪些加密设置。