Splunk DB Connect – Unable to Establish SQL Server 2016 Connection Due to SSL Certificate Validation Error

[NightOwl2212]

Hello ,

I'm trying to establish a database connection using Splunk DB Connect to Microsoft SQL Server 2016. However, the connection validation fails with the following error:

Error Message:

Database connection enoc_o is invalid.

"encrypt" property is set to "true" and
"trustServerCertificate" property is set to "false",
but the driver could not establish a secure connection
to SQL Server using SSL encryption.

Error: (certificate_unknown)
PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target.

we tested all possible combinations of the following JDBC connection properties:

1. encrypt=true;trustServerCertificate=false

2. encrypt=true;trustServerCertificate=true

3. encrypt=false;trustServerCertificate=false

4. encrypt=false;trustServerCertificate=true

Despite trying all these combinations, we are still unable to establish the connection through DB Connect.

Additional Information:

The database administrator has confirmed that they can successfully connect to the SQL Server using the same database account (siemuser) and retrieve data. Therefore, the credentials and database accessibility appear to be working from their side.

[PickleRick]

"Trust but verify". It's good that the admin says they've enabled TLS but I'd go and check.

openssl s_client -connect <your_SQL_server>:1433

(Or whatever your configured port is)

[NightOwl2212]

Hi @PickleRick ,
Checked and verified.

[PickleRick]

You verified that the server actually does _not_ present a certificate which means it doesn't have TLS enabled on this port. I had a similar case lately. It required fixing on the server side. I'm not sure what it was but I suspect it probably just needed restarting the server process - I supposed just enabling TLS on the port just required restart. But there might have been something else. I'm not an MSSQL expert. What I know though is that after some "fix" on the server side, the server correctly introduces itself with a certificate after connection to its port.

[JohnEGones]

Try this:

• Open $JAVA_HOME/lib/security/java.security and comment out or remove lines that disable the algorithms DB Connect needs.

  Example:

  # jdk.certpath.disabledAlgorithms = SHA1withRSA, ECDSA
  # jdk.tls.disabledAlgorithms = TLSv1.2, TLSv1.3
  # jdk.disabled.namedCurves = secp256k1
  

• Ensure the algorithms you need (e.g., TLSv1.2, TLSv1.3, secp256k1) are allowed.

[NightOwl2212]

Hi @JohnEGones ,
I have tried but still the same issue.