topic DB Connect Addon Integration Issue - Microsoft SQL Server 2012 in Getting Data In

DB Connect Addon Integration Issue - Microsoft SQL Server 2012

kiranpanchavat1 — Thu, 24 Feb 2022 13:48:35 GMT

Hello Team,

We are trying to integrate one of the SQL data base using the splunk db connect add-on and we are getting the below error. Id MS SQL 2012 is compatible with the below db connect and splunkversions ?

Splunk DB Connect

Version: 3.5.1 Build: 4 Splunk Enterprise : 8.1.7.2

DB version is Microsoft SQL Server 2012

ERROR :

The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "Certificates do not conform to algorithm constraints". ClientConnectionId:xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Re: DB Connect Addon Integration Issue - Microsoft SQL Server 2012

kiranpanchavat1 — Thu, 03 Mar 2022 07:15:28 GMT

can anyone please provide an update on this ?

Re: DB Connect Addon Integration Issue - Microsoft SQL Server 2012

andrew207 — Mon, 21 Nov 2022 03:25:43 GMT

I have hit this problem too, and it's a bit awkward. Here's what I have learned:

- Even with encrypt=false in your JDBC URL, authentication still occurs over TLS.

- MSSQL 2014 uses 1024-bit keys by default

- Newer versions of JRE/JDK (not sure when it changed) specify minimum key lengths of 2048 for RSA

I am working to solve this by having the MSSQL team configure suitable certs signed by our PKI. As a temporary workaround you may be able to set this:

#$JAVA_HOME/lib/security/java.security
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, RSA keySize < 1024

Notably, we are changing the disabled RSA keySize to <1024, which would allow the 1024-bit keys used by default in MSSQL14 -- even when SSL is explicitely disabled in the JDBC URL.

Re: DB Connect Addon Integration Issue - Microsoft SQL Server 2012

andrew207 — Tue, 22 Nov 2022 21:46:03 GMT

jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, RSA keySize < 1024

Just as a followup, performing this change to allow RSA keysizes of 1024 bits worked fine and when combined with explicitly specifying encrypt=false in the JDBC URL we now have working connectivity.