Trying to enable encryption to sql database

[Socko-71]

I'm trying to get the Confluence database connection to use encryption: My current setting is: <property name="hibernate.connection.url">jdbc:jtds:sqlserver://xx-xxxx-dev.xxxxxxxxxxxx.com:49666/confluencedev_db;secure=true;useSSL=true;requireSSL</property> I have setup other connections on other apps using this connection: 

jdbc.url=jdbc:sqlserver://xx-xxxx-dev.xxxxxxxxxxxx.com:49666;databaseName=BitBucket;instance=secure;encrypt=true;trustServerCertificate=true;  This works just fine..any idea on the Confluence?

[Philbert Pagaspas]

postgres jdbc:

Jira dbconfig.xml,  append ?ssl=true

Confluence confluence.cfg.xml, append ?sslmode=require

[AnnWorley]

It's a known issue:

Oracle introduced a security fix for the SSL/TLS BEAST attack that is known to interfere with Microsoft JDBC/jTDS connections....

Official Bug Report:

https://bugs.openjdk.java.net/browse/JDK-8014272

To be able to connect to MS SQL securely you will have to disable the fix for the SSL/TLS BEAST attack, and hence, the DB server will be vulnerable to this type of attack. The instructions are described on Cannot Connect Confluence to MS SQL Server Using Force Encryption

[Socko-71]

Thanks for the reply but unfortunately the article refereed to the setenv.bat  to look for the java options (java_opts). Our setenv.bat uses CATALINA_OPTS instead.

Thanks

[AnnWorley]

Hopefully you are installing Confluence as a service, in which case the catalina options are passed via the service rather than the setenv.bat. When Confluence starts as a service the parameters in sertenv.bat are ignored. This document has screen shots showing how to set the system properties for the Windows service: Windows service

Thank you for pointing out the oversight of the doc that fails to mention that CATALINA_OPTS have been used since Confluence 5.5. I will work on editing it.

[Socko-71]

No thanks you for just a fast response. I forwarded the link to our server team. I will let you know if it fixed my issue. 

Thanks

[AnnWorley]

I look forward to your update with high hopes.

[Socko-71]

Well poo, with the options: confluencedev_db;secure=true;useSSL=true;requireSSL I get database connects but not encrypted and checking the log file I still get the "SQLException: I/O Error: DB server closed connection..etc..". Using confluencedev_db;SSL=true I loose the data connections but still get the "SQLException: I/O Error: DB server closed connection..etc.." in the log file... :)

[AnnWorley]

Hi Bob,

Please set the system property;

 -Djsse.enableCBCProtection=false

for the Confluence service, following: Cannot Connect Confluence to MS SQL Server Using Force Encryption

Please make sure your JDBC URL is like this:

jdbc:jtds:sqlserver://YourDatabaseServer:1433/YourConfluenceDatabase;ssl=true

Thanks,

Ann 

[Socko-71]

-Djsse.enableCBCProtection=false (was previously set)

Change line in confluence.cfg.xml from:confluencedev_db;secure=true;useSSL=true;requireSSL

to: confluencedev_db;SSL=true

Still getting (first few lines of log)

HelperThread-#1] [mchange.v2.resourcepool.BasicResourcePool] log com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask@4ae93aea -- Acquisition Attempt Failed!!! Clearing pending acquires. While trying to acquire a needed new resource, we failed to succeed more than the maximum number of allowed acquisition attempts (30). Last acquisition attempt exception:
java.sql.SQLException: I/O Error: DB server closed connection.
at net.sourceforge.jtds.jdbc.TdsCore.nextToken(TdsCore.java:2481)
at net.sourceforge.jtds.jdbc.TdsCore.login(TdsCore.java:632)
at net.sourceforge.jtds.jdbc.JtdsConnection.<init>(JtdsConnection.java:371)
at net.sourceforge.jtds.jdbc.Driver.connect(Driver.java:184)
at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:175)
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection

[AnnWorley]

Hi Bob,

I opened a support request so we could use the file sharing feature of the portal to take a closer look. Please watch your inbox for a notification of the ticket.

When we sort this out we can circle back and let the Community know the resolution.

Thanks,

Ann