Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-78125

When using SQL Server as a database Jira fails to start due to jdbc driver default encryption settings

XMLWordPrintable

    • 10
    • Severity 1 - Critical
    • Hide

      This is caused by the usage of the JDBC driver for MSSQL in version 10.2 and later, which introduced a breaking change in encryption defaults(changes of default value of encrypt connection parameter(from false in previously used 9.2.1 driver to true in 12.6.3.jre11 driver used in Jira 10.0.1) seems to be the root cause here. ).

      Seems only 10.0.1 is affected by this problem as later and earlier versions us the non breaking 9.2.1.jre8 version of the driver.

      .

      Show
      This is caused by the usage of the JDBC driver for MSSQL in version 10.2 and later, which introduced a breaking change in encryption defaults(changes of default value of encrypt connection parameter(from false in previously used 9.2.1 driver to true in 12.6.3.jre11 driver used in Jira 10.0.1) seems to be the root cause here. ). Seems only 10.0.1 is affected by this problem as later and earlier versions us the non breaking 9.2.1.jre8 version of the driver. .

      Issue Rummary

      This is reproducible on Data Center: yes

      Steps to Reproduce

      Start Jira using MSSQL as the database

      Expected Results

      Jira starts properly

      Actual Results

      Jira starts in locked state. Logs show the following error

      2024-09-27 09:40:55,819+0200 JIRA-Bootstrap ERROR      [c.a.c.internal.bootstrap.DefaultAtlassianBootstrapManager] Could not successfully test your database: com.microsoft.sqlserver.jdbc.SQLServerException: "encrypt" property is set to "true" and "trustServerCertificate" property is set to "false" but the driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption: Error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. ClientConnectionId:2cbeec88-c09e-4d2a-ba87-6db373d6bbce  at com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnection.java:4290)  at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1965)  at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:3816)  at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:3372)  at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:3197)  at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:1971)  at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1263)  at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:681)  at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:229)  at com.atlassian.config.internal.bootstrap.DefaultAtlassianBootstrapManager.getTestDatabaseConnection(DefaultAtlassianBootstrapManager.java:286)  at com.atlassian.jira.config.database.JdbcDatasource.getConnection(JdbcDatasource.java:228)  at com.atlassian.jira.config.database.DatabaseConfig.testConnection(DatabaseConfig.java:88)  at com.atlassian.jira.health.checks.DbConfigurationAndConnectionCheck.doPerform(DbConfigurationAndConnectionCheck.java:60)  at com.atlassian.jira.health.HealthCheckTemplate.perform(HealthCheckTemplate.java:23)  at com.atlassian.jira.health.DefaultHealthCheckExecutor.runCheck(DefaultHealthCheckExecutor.java:76)  at com.atlassian.jira.health.DefaultHealthCheckExecutor.lambda$applyAndCollectExceptions$1(DefaultHealthCheckExecutor.java:55)  at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183)  at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)  at java.base/java.util.Iterator.forEachRemaining(Iterator.java:133)  at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1845)  at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)  at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)  at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)  at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)  at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)  at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)  at com.atlassian.jira.health.DefaultHealthCheckExecutor.applyAndCollectExceptions(DefaultHealthCheckExecutor.java:55)  at com.atlassian.jira.health.DefaultHealthCheckExecutor.performHealthChecks(DefaultHealthCheckExecutor.java:44)  at com.atlassian.jira.health.HealthChecks.executeChecksAndRecordResults(HealthChecks.java:164)  at com.atlassian.jira.health.HealthChecks.runHealthChecks(HealthChecks.java:154)  at com.atlassian.jira.health.HealthChecks.runHealthChecks(HealthChecks.java:66)  at com.atlassian.jira.startup.BootstrapContainerLauncher.start(BootstrapContainerLauncher.java:48)  at com.atlassian.jira.startup.DefaultJiraLauncher.preDbLaunch(DefaultJiraLauncher.java:123)  at com.atlassian.jira.startup.DefaultJiraLauncher.lambda$start$0(DefaultJiraLauncher.java:108)  at com.atlassian.jira.util.devspeed.JiraDevSpeedTimer.run(JiraDevSpeedTimer.java:31)  at com.atlassian.jira.startup.DefaultJiraLauncher.start(DefaultJiraLauncher.java:107)  at com.atlassian.jira.startup.LauncherContextListener.initSlowStuff(LauncherContextListener.java:162)  at java.base/java.lang.Thread.run(Thread.java:840) 
      Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:378)  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:316)  at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)  at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)  at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)  at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)  at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)  at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:458)  at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:201)  at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)  at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1510)  at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1425)  at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)  at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)  at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1854)  ... 36 moreCaused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)  at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)  at java.base/sun.security.validator.Validator.validate(Validator.java:264)  at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:242)  at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:113)  at com.microsoft.sqlserver.jdbc.HostNameOverrideX509TrustManager.checkServerTrusted(SQLServerTrustManager.java:88)  at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1439)  at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)  ... 48 moreCaused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:148)  at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:129)  at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)  at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)  ... 55 more2024-09-27 09:40:55,835+0200 JIRA-Bootstrap ERROR      [c.a.jira.health.HealthChecks] JIRA couldn't connect to your database2024-09-27 09:40:55,835+0200 JIRA-Bootstrap ERROR      [c.a.jira.health.HealthChecks] JIRA failed to establish a connection to your database. 

       

      Workaround

      Later versions of Jira (10.1.1 and forward) do not use this driver version.

              Unassigned Unassigned
              jreczycki Jakub Reczycki
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: