JDK-8014273 : Connection failure with SQL Server " Force Encryption " for Java6 U34-35 & 7U6-7
  • Type: Bug
  • Component: security-libs
  • Affected Version: 7
  • Priority: P3
  • Status: Resolved
  • Resolution: Duplicate
  • Submitted: 2013-04-04
  • Updated: 2013-05-16
  • Resolved: 2013-05-16
Related Reports
Duplicate :  
Description
FULL PRODUCT VERSION :
java version  " 1.6.0_34 " 
Java(TM) SE Runtime Environment (build 1.6.0_34-b04)
Java HotSpot(TM) Client VM (build 20.9-b04, mixed mode)
--------------------------------------------------------------------------------------
java version  " 1.6.0_35 " 
Java(TM) SE Runtime Environment (build 1.6.0_35-b10)
Java HotSpot(TM) Client VM (build 20.10-b01, mixed mode, sharing)
--------------------------------------------------------------------------------------
java version  " 1.7.0_06 " 
Java(TM) SE Runtime Environment (build 1.7.0_06-b24)
Java HotSpot(TM) Client VM (build 23.2-b09, mixed mode)
--------------------------------------------------------------------------------------
java version  " 1.7.0_07 " 
Java(TM) SE Runtime Environment (build 1.7.0_07-b11)
Java HotSpot(TM) Client VM (build 23.3-b01, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Windows 7 Professional 32-bit

Microsoft Windows [Version 6.1.7601]

EXTRA RELEVANT SYSTEM CONFIGURATION :
Database Server:
Windows 7 Professional 32-bit
SQL Server 2008 R2 SP2

A DESCRIPTION OF THE PROBLEM :
Happens for Java 6 U34-35, Java 7 U6-7

Application Information:
Java Desktop Application
jTDS 1.2.2 (later tried with 1.2.6)

When the database server has set  " Force Encryption "  to  " Yes " , applications would not connect properly to it (using JRE 6 U34,3U5 or JRE 7 U6, U7). Configuring the application to use an earlier Java version (Java 6 Update 33 or lower, Java 7 Update 5 or lower) would immediately solve the problem.

* Turning off  " Force Encryption "  on the database server would allow all versions of Java (Java 6 U35 and Java 7 U7) to work, but that is not an option at the client site.

* No certificate was created for the server, in this case SQL Server should create a self-signed certificate on its own.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
1. Setup an SQL Server 2008 R2 instance and patch it up to SP2. Configure the server to have the  " Force Encryption "  option turned-on.

2. Create an application that would connect to the database with jtds 1.2.6, and set the SSL parameter to request, something like the following connection string (this would connect to the master database):

jdbc:jtds:sqlserver://SQLSERVER:1433/master;useLOBs=false;SSL=request

* Use any of the following JVMs: Java 6 U34 Java 6 U35, Java 7 U6, Java 7 U7

3. Run the application

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Application should be able to establish a connection with the database
ACTUAL -
Application would just time-out connecting to the database. Or it would just seem to sit idle while attempting to connect to the database.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
- No error message, application is just stuck

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
//Straight-forward application that connects to the database and retrieves the current date

static final String JDBC_DRIVER =  " net.sourceforge.jtds.jdbc.Driver " ;
    static final String DB_URL =  " jdbc:jtds:sqlserver://SQLSERVER:1433/master;useLOBs=false;SSL=request " ;

    static final String USER =  " sa " ;
    static final String PASS =  " P@ssw0rd " ;

        Connection conn = null;
        Statement stmt = null;
        try {
            Class.forName(JDBC_DRIVER);
            conn = DriverManager.getConnection(DB_URL, USER, PASS);
            stmt = conn.createStatement();
            String sql;
            sql =  " SELECT GETDATE() " ;
            ResultSet rs = stmt.executeQuery(sql);

            while (rs.next()) {
                String currDate = rs.getString(1);
                System.out.print( " Current DB Date: "  + currDate);
            }
            rs.close();
            stmt.close();
            conn.close();
        } catch (SQLException se) {
            se.printStackTrace();
        } catch (Exception e) {
            e.printStackTrace();
        } finally {
            try {
                if (stmt != null)
                    stmt.close();
            } catch (SQLException se2) {}
            try {
                if (conn != null)
                    conn.close();
            } catch (SQLException se) {}
        }
    
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
- Disable  " Force Encryption "  on SQL Server
- Use a lower JRE version
Comments
The customer that submitted this is not reachable. I have been in contact with the customer from 8014272, and he has provided dumps that seem to duplicate the issue mentioned by this customer. I am closing this as a dup.
16-05-2013

Sending a note to the customer to see if I can get debug output. This may be related to JDK-7174244.
15-05-2013

This has the indications of being BEAST related, but BEAST was fixed in 7u1, this claims that it works in 7u5. Wonder if this is related to JDK-8014272? Can you turn on the System property: -Djsse.enableCBCProtection=false and see if there is still a hang?
09-05-2013