# SQL driver issue

**URL:** <https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479>\
**Category:** IIQ Discussion and Questions\
**Tags:** identityiq\
**Created:** [November 23, 2023, 2:02am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479 "2023-11-23T02:02:22Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![dheerajk27](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/dheerajk27/32/3514_2.png) [@dheerajk27](https://developer.sailpoint.com/discuss/u/dheerajk27)\
**Post date:** [November 23, 2023, 2:02am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/1 "2023-11-23T02:02:22Z")

</div>

HI Team,

Recently I have upgraded from 8.2.p2 to 8.3 in my sandbox environment running on azure SQLServer instance, everything seems working fine however can see that for one JDBC connector using SQLServer driver is failing with below error, i have already updated latest SQL driver jar from 10.2 to 12.0

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/6/6fdcd3736938293245f83289f27156616fbea5c4.png)

any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![Remold](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/remold/32/3275_2.png) [@Remold](https://developer.sailpoint.com/discuss/u/Remold)\
**Post date:** [November 23, 2023, 7:05am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/2 "2023-11-23T07:05:04Z")

</div>

Can you test with changing the URI to end it with:  
`trustservercertificate=true;encrypt=false`

– Remold

---

<div class="post-metadata">

**Author:** ![dheerajk27](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/dheerajk27/32/3514_2.png) [@dheerajk27](https://developer.sailpoint.com/discuss/u/dheerajk27)\
**Post date:** [November 23, 2023, 8:29am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/3 "2023-11-23T08:29:17Z")

</div>

Hi @Remold ,

Thank you for the response, i am still getting same error.

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/9/91d8db566740b2a5eab2a92ecc3a84077186145b.png)

---

<div class="post-metadata">

**Author:** ![kjakubiak](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kjakubiak/32/7052_2.png) [@kjakubiak](https://developer.sailpoint.com/discuss/u/kjakubiak)\
**Post date:** [November 23, 2023, 5:01pm UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/4 "2023-11-23T17:01:20Z")

</div>

Hi Dheeraj,  
It looks like the issue with rsa key length limitation caused by java security.

Can you check in your java security if jdk.certpath.disabledAlgorithms contains something like RSA keySize \< 1024

It would be better to make the key size more then 1024 but as its a sandbox i think you can test it first with disabling this check.

---

<div class="post-metadata">

**Author:** ![dheerajk27](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/dheerajk27/32/3514_2.png) [@dheerajk27](https://developer.sailpoint.com/discuss/u/dheerajk27)\
**Post date:** [November 24, 2023, 2:43am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/5 "2023-11-24T02:43:32Z")

</div>

> [@Remold](#):
>
> trustservercertificate=true;encrypt=false

Thankyou @kjakubiak  
below is the jdk.certpath.disabledAlgorithm in my java.security, i increased the keySize to 2024 but still, getting same error:

jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer,   
RSA keySize \< 1024, DSA keySize \< 1024, EC keySize \< 224,   
include jdk.disabled.namedCurves

below is additional logs:

```auto
Caused by: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on keysize limits: RSA 1024 bit key used with certificate: CN=SSL_Self_Signed_Fallback
        at sun.security.util.DisabledAlgorithmConstraints$KeySizeConstraint.permits(DisabledAlgorithmConstraints.java:889) ~[?:?]
        at sun.security.util.DisabledAlgorithmConstraints$Constraints.permits(DisabledAlgorithmConstraints.java:507) ~[?:?]
        at sun.security.util.DisabledAlgorithmConstraints.permits(DisabledAlgorithmConstraints.java:247) ~[?:?]

```

---

<div class="post-metadata">

**Author:** ![dheerajk27](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/dheerajk27/32/3514_2.png) [@dheerajk27](https://developer.sailpoint.com/discuss/u/dheerajk27)\
**Post date:** [November 24, 2023, 3:40am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/6 "2023-11-24T03:40:44Z")

</div>

additional info i am using “mssql-jdbc-12.4.2.jre11.jar” and “com.microsoft.sqlserver.jdbc.SQLServerDriver” driver name

---

<div class="post-metadata">

**Author:** ![chaitanyav](https://avatars.discourse-cdn.com/v4/letter/c/f475e1/32.png) [@chaitanyav](https://developer.sailpoint.com/discuss/u/chaitanyav)\
**Post date:** [November 24, 2023, 2:24pm UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/7 "2023-11-24T14:24:05Z")

</div>

Can you add this to your tomcat server startup options :

```auto
-Djava.security.disableSystemPropertiesFile=true

```

---

<div class="post-metadata">

**Author:** ![kjakubiak](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kjakubiak/32/7052_2.png) [@kjakubiak](https://developer.sailpoint.com/discuss/u/kjakubiak)\
**Post date:** [November 24, 2023, 4:03pm UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/8 "2023-11-24T16:03:38Z")

</div>

Hi Dheeraj,  
Did you change the key to 2048 in the database or in java security file?

---

<div class="post-metadata">

**Author:** ![dheerajk27](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/dheerajk27/32/3514_2.png) [@dheerajk27](https://developer.sailpoint.com/discuss/u/dheerajk27)\
**Post date:** [November 27, 2023, 5:21am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/9 "2023-11-27T05:21:19Z")

</div>

Hi @kjakubiak ,

Yes i did change the keySize\<2048 in java.security file.

---

<div class="post-metadata">

**Author:** ![kjakubiak](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kjakubiak/32/7052_2.png) [@kjakubiak](https://developer.sailpoint.com/discuss/u/kjakubiak)\
**Post date:** [November 27, 2023, 5:30am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/10 "2023-11-27T05:30:17Z")

</div>

Hi Dheeraj,  
So generaly what you did is oposit to what you wanted to achieve 🙂 now you enforce that the must have at least 2048 to work. I would suggest to just keep MD2, MD5 and SHA1 in the disabledAlgorythms and remove the rest.

---

<div class="post-metadata">

**Author:** ![dheerajk27](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/dheerajk27/32/3514_2.png) [@dheerajk27](https://developer.sailpoint.com/discuss/u/dheerajk27)\
**Post date:** [November 27, 2023, 8:26am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/11 "2023-11-27T08:26:02Z")

</div>

> [@chaitanyav](#):
>
> `-Djava.security.disableSystemPropertiesFile=true`

Updated , but got same error:

![image](https://global.discourse-cdn.com/sailpoint/original/2X/4/405b6d69a15afd88dea342206c48ab39a82e8381.png)  
p

om.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: “Certificates do not conform to algorithm constraints”. ClientConnectionId:26ae0198-970a-4a66-bf15-e0a09

---

<div class="post-metadata">

**Author:** ![Remold](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/remold/32/3275_2.png) [@Remold](https://developer.sailpoint.com/discuss/u/Remold)\
**Post date:** [November 27, 2023, 10:54am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/12 "2023-11-27T10:54:04Z")

</div>

Can you validate the certificate to see the keysize and type?

```auto
openssl x509 -pubkey -noout -text -inform DER -in <certificate filename>

```

You can also take a look at:  
[https://www.java-success.com/debugging-java-security-cert-certificateexception-certificates-does-not-conform-to-algorithm-constraints/](https://www.java-success.com/debugging-java-security-cert-certificateexception-certificates-does-not-conform-to-algorithm-constraints/)

– Remold

---

<div class="post-metadata">

**Author:** ![Remold](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/remold/32/3275_2.png) [@Remold](https://developer.sailpoint.com/discuss/u/Remold)\
**Post date:** [November 27, 2023, 2:25pm UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/13 "2023-11-27T14:25:50Z")

</div>

Another solution might be:  
Removing SHA-1 from the disabled algorithms in retain.jdk.security file in the tomcat/conf folder

Toghether with removal of the SHA-1 from jdk.certpath.disabledAlgorithms

– Remold

---

<div class="post-metadata">

**Author:** ![dheerajk27](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/dheerajk27/32/3514_2.png) [@dheerajk27](https://developer.sailpoint.com/discuss/u/dheerajk27)\
**Post date:** [November 28, 2023, 3:10am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/14 "2023-11-28T03:10:26Z")

</div>

> [@Remold](#):
>
> trustservercertificate=true;encrypt=false

Hi Everyone,

Thankyou for getting into this and helping me to resolve this issue, actually in java. Security file `security.useSystemPropertiesFile=true` parameter is set true.

This is why any change i was doing in java.Security file was getting overridden with another`/etc/crypto-policies/back-ends/java.config` file on RSA keySize\<2048 was mentioned.

Now i am able to connect successfully. Thankyou all for your valuable suggestion and help, really appreciate !!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [January 27, 2024, 3:11am UTC](https://developer.sailpoint.com/discuss/t/sql-driver-issue/21479/15 "2024-01-27T03:11:22Z")

</div>

Closed on January 27, 2024, 3:11am UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.