Regresar
-
Título
Cannot connect to SQL PI repository due "SQL Server did not return a response" error -
Descripción
The PI extension cannot be enabled for database agents due to the following error when connecting to a SQL Server PI repository on Windows 2019.
ERROR [0] script.system:dbwc_spi20repository_installer_apis.validatePIConnection - Failed to establish connection to PI repository from the FMS. Cannot create PoolableConnectionFactory (The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "SQL Server did not return a response. The connection has been closed. ClientConnectionId".). Error: SQL Server did not return a response. The connection has been closed. ClientConnectionId:. simpleSqlProfile dump => <com.dell.dsgi.spi.common.utils.sql.mssql.MsSqlProfile@395fc917 delegateMSSQLProfile=MSSQLProfile{host='HOSTNAME', instance= 'SQLPI', username='USERNAME', authType= 'SQL_SERVER', port= '1433' useNTLMv2= 'false', socketTimeout= '0', database= 'null', secureConnection= 'OFF', packetSize= '0', ApplicationIntent= 'NONE', enforceSSLVersion= 'NONE', lockTimeout= '10000', codePageOverride = '', selectMethod='' } host=HOSTNAME port=1433 database=null user=USERNAME pa$
org.apache.commons.dbcp.SQLNestedException: Cannot create PoolableConnectionFactory (The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "SQL Server did not return a response. The connection has been closed. ClientConnectionId:".)
Caused by: com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "SQL Server did not return a response. The connection has been closed. ClientConnectionId:".
ERROR [0] com.quest.wcf.core.module.function.FunctionManager - Error executing script id=system:dbwc_spi20repository_installer_apis.validatePIConnection name="'Validate PI Connection' from the System module Databases/SQL PI Repository/Installer/APIs"
message: com.quest.nitro.service.sl.interfaces.scripting.ScriptingException: com.quest.nitro.service.sl.interfaces.scripting.ScriptAbortException: com.quest.qsi.fason.framework.installer.exceptions.InstallerServiceException: org.apache.commons.dbcp.SQLNestedException: Cannot create PoolableConnectionFactory (The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "SQL Server did not return a response. The connection has been closed. ClientConnectionId.) -
Causa
TLS v1.3 was enabled on the PI repository server.
According to Microsoft TLS v1.3 can be enabled but is not supported on Windows 2019
https://learn.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-
There is a little debate from third party websites if TLS v1.3 is supported in Windows 2019 from the 18362 (1903) build, but the customer's server was on a 17763 build (1809).
-
Resolución
RESOLUTION 1
A). Disable TLS v1.3 in the registry of the PI repository server
- Find the following path in the left panel of the Registry Editor: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client]
- Double-click on [Enabled].
- In the [Value data] field, change the value to [0] and click [OK].
RESOLUTION 2
Edit the java.security files on the FMS and FglAM to add TLS v1.3 in the jdk.tls.disabledAlgorithms line
- After the FMS has been upgraded but before running the upgrade on the DB cartridges, navigate to the the Java.Security file locations on both the Foglight Agent Manager (FglAM) and FMS
- On an external Fglam this would be {fglam}\jre\{version}lib\security\
- Using an embedded FglAM this would be {fms}\jre\lib\security\
- Open the file java.security in a text editor
- Search for the property jdk.tls.disabledAlgorithms
- The line would be similar to jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
- Add the TLSv1.3 entry, this prevent the JDK from using it
- Save the file
- Restart the Foglight Agent Manager and FMS
- Upgrade the database cartridges in the UI as usual