[MS SQL] JDBC 접속시 평문인데 SSL 암호 뜰때 대처법

1. 조사배경

  - 묵혀둔 MSSql이 있었다. (한 2년 접속 안함)

  - 접속하니 enableSSL xxx 하면서 ssl 로그가 뜬다.

  - 다음과 같은 로그를 남기고 접속이 안된다.

   드라이버가 SSL(Secure Sockets Layer) 암호화를 사용하여 SQL Sever로 보안 연결을 설정할 수 없습니다. 오류: "java.security.cert.CertificateException: Certificates do not conform to algorithm constraints". ClientConnectionId:60f65f8c-e751-4cff-90d9-69928ae25ef8

2. 원인

  java 가 Update되면서 일부 key를 사용못하게 함

  즉 client 는 최신

     server는 Old ==> 

  즉 서버에서 키 문제가 존재하는 것으로 handshake 할려고 하는데.. 그게 문제가 되는가 부다.

3. 해결

client의   JRE_HOME/lib/security/java.security 파일을 열어서

  다음 속성

 jdk.certpath.disabledAlgorithms

 jdk.tls.disabledAlgorithms

을 주석 처리함.. 즉 알고리즘 다 사용하게 함...

==>  정확히 처리할려면 서버도 알고리즘을 맞추어 주어야 되는데 mssql ssl 알고리즘 설정을 어디서 하는지 모르겠다.

# 참고

1. 에러 원문

 com.microsoft.sqlserver.jdbc.SQLServerException: 드라이버가 SSL(Secure Sockets Layer) 암호화를 사용하여 SQL Sever로 보안 연결을 설정할 수 없습니다. 오류: "java.security.cert.CertificateException: Certificates do not conform to algorithm constraints". ClientConnectionId:60f65f8c-e751-4cff-90d9-69928ae25ef8

at com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnection.java:1668)

at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1668)

at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:1324)

at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:992)

at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:828)

at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1012)

at java.sql.DriverManager.getConnection(DriverManager.java:664)

at java.sql.DriverManager.getConnection(DriverManager.java:208)

at com.somansa.db.connection.DBConnection.getConnection(DBConnection.java:238)

at com.somansa.db.connection.PIScanDBConnection.InspectDBStructure(PIScanDBConnection.java:332)

at com.somansa.manager.PITargetDBManager.inspectDBStructure(PITargetDBManager.java:588)

at com.somansa.manager.PIGetDBInfoManager.getDBinfoProcess(PIGetDBInfoManager.java:41)

at com.somansa.manager.PIGetDBInfoManager.run(PIGetDBInfoManager.java:133)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

at java.lang.Thread.run(Thread.java:748)

Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificates do not conform to algorithm constraints

at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1946)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:316)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310)

at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639)

at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)

at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)

at sun.security.ssl.Handshaker.process_record(Handshaker.java:965)

at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)

at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)

at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)

at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)

at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1618)

... 14 more

Caused by: java.security.cert.CertificateException: Certificates do not conform to algorithm constraints

at sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraints(SSLContextImpl.java:1127)

at sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:1051)

at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:993)

at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)

... 22 more

Caused by: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on keysize limits. RSA 512bit key used with certificate: CN=RIKKY-PC-X64.  Usage was tls server

at sun.security.util.DisabledAlgorithmConstraints$KeySizeConstraint.permits(DisabledAlgorithmConstraints.java:817)

at sun.security.util.DisabledAlgorithmConstraints$Constraints.permits(DisabledAlgorithmConstraints.java:419)

at sun.security.util.DisabledAlgorithmConstraints.permits(DisabledAlgorithmConstraints.java:167)

at sun.security.provider.certpath.AlgorithmChecker.check(AlgorithmChecker.java:332)

at sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraints(SSLContextImpl.java:1123)

... 25 more

2. 참고 사이트

https://stackoverflow.com/questions/21218217/ssl-handshake-exception-algorithm-constraints-check-failed-md5withrsa