title: sqljdbc4.jar - cannot connect to MSSQL server instance - SSL error?
body: <p>I'm using this code to connect to an MSSQL 2012 instance from OpenJDK1.8 using sqljdbc4.jar on an Ubuntu box:</p>
  <pre class="lang-java prettyprint-override"><code>public static DataSource getMsSqlPoolSource(String server, String database, String user, String password) throws ClassNotFoundException {
      Class.forName(&quot;com.microsoft.sqlserver.jdbc.SQLServerDriver&quot;);
  
      String connectionString = &quot;jdbc:sqlserver://&quot; + server + &quot;;databaseName=&quot; + database + &quot;;sendStringParametersAsUnicode=false;&quot;;
      System.out.println(&quot;Connection String for MSSQL is:: &quot; + connectionString);
      org.apache.commons.dbcp2.ConnectionFactory factory = new DriverManagerConnectionFactory(connectionString, user, password);
      PoolableConnectionFactory poolFactory = new PoolableConnectionFactory(factory, null);
      ObjectPool&lt;PoolableConnection&gt; connectionPool = new GenericObjectPool&lt;&gt;(poolFactory);
      poolFactory.setPool(connectionPool);
      PoolingDataSource&lt;PoolableConnection&gt; dataSource = new PoolingDataSource&lt;&gt;(connectionPool);
      return dataSource;
  }
  </code></pre>
  <p>This was working for three years, until today.</p>
  <p>If I now try to connect from the same Ubuntu box to the same MSSQL 2012 instance as the past three years, I get an exception:</p>
  <pre class="lang-none prettyprint-override"><code>2021-07-31 10:01:07.125 ERROR vsCallLogSyncOnVerinet - SQL ERROR:: 1jyg0yezlh46 - invalid database address: jdbc:sqlserver://172.16.1.244;databaseName=my_DB;sendStringParametersAsUnicode=false;
  Security providers: [SUN version 1.8, SunRsaSign version 1.8, SunEC version 1.8, SunJSSE version 1.8, SunJCE version 1.8, SunJGSS version 1.8, SunSASL version 1.8, XMLDSig version 1.8, SunPCSC version 1.8]
  SSLContext provider info: Sun JSSE provider(PKCS12, SunX509/PKIX key/trust factories, SSLv3/TLSv1/TLSv1.1/TLSv1.2/TLSv1.3)
  SSLContext provider services:
  [SunJSSE: KeyFactory.RSA -&gt; sun.security.rsa.RSAKeyFactory$Legacy
    aliases: [1.2.840.113549.1.1, OID.1.2.840.113549.1.1]
  , SunJSSE: KeyPairGenerator.RSA -&gt; sun.security.rsa.RSAKeyPairGenerator$Legacy
    aliases: [1.2.840.113549.1.1, OID.1.2.840.113549.1.1]
  , SunJSSE: Signature.MD2withRSA -&gt; sun.security.rsa.RSASignature$MD2withRSA
    aliases: [1.2.840.113549.1.1.2, OID.1.2.840.113549.1.1.2]
  , SunJSSE: Signature.MD5withRSA -&gt; sun.security.rsa.RSASignature$MD5withRSA
    aliases: [1.2.840.113549.1.1.4, OID.1.2.840.113549.1.1.4]
  , SunJSSE: Signature.SHA1withRSA -&gt; sun.security.rsa.RSASignature$SHA1withRSA
    aliases: [1.2.840.113549.1.1.5, OID.1.2.840.113549.1.1.5, 1.3.14.3.2.29, OID.1.3.14.3.2.29]
  , SunJSSE: Signature.MD5andSHA1withRSA -&gt; sun.security.ssl.RSASignature
  , SunJSSE: KeyManagerFactory.SunX509 -&gt; sun.security.ssl.KeyManagerFactoryImpl$SunX509
  , SunJSSE: KeyManagerFactory.NewSunX509 -&gt; sun.security.ssl.KeyManagerFactoryImpl$X509
    aliases: [PKIX]
  , SunJSSE: TrustManagerFactory.SunX509 -&gt; sun.security.ssl.TrustManagerFactoryImpl$SimpleFactory
  , SunJSSE: TrustManagerFactory.PKIX -&gt; sun.security.ssl.TrustManagerFactoryImpl$PKIXFactory
    aliases: [SunPKIX, X509, X.509]
  , SunJSSE: SSLContext.TLSv1 -&gt; sun.security.ssl.SSLContextImpl$TLS10Context
    aliases: [SSLv3]
  , SunJSSE: SSLContext.TLSv1.1 -&gt; sun.security.ssl.SSLContextImpl$TLS11Context
  , SunJSSE: SSLContext.TLSv1.2 -&gt; sun.security.ssl.SSLContextImpl$TLS12Context
  , SunJSSE: SSLContext.TLSv1.3 -&gt; sun.security.ssl.SSLContextImpl$TLS13Context
  , SunJSSE: SSLContext.TLS -&gt; sun.security.ssl.SSLContextImpl$TLSContext
    aliases: [SSL]
  , SunJSSE: SSLContext.Default -&gt; sun.security.ssl.SSLContextImpl$DefaultSSLContext
  , SunJSSE: KeyStore.PKCS12 -&gt; sun.security.pkcs12.PKCS12KeyStore
  ]
  java.ext.dirs: /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/ext:/usr/java/packages/lib/ext
  </code></pre>
  <p>I recently added some certificates to the OpenJDK1.8 certificate store for two domains unrelated to the direct by-ip connection on my local Class B where I connect to the local MSSQL instance via my Class B LAN.</p>
  <p>Why is the MSSQL JDBC driver causing an apparent exception involving certificates suddenly, and refusing to connect?</p>
  <p>I do not want the JDBC driver to use any certificate I added, it must just proceed normally and ignore them?</p>
  <p>I have another Ubuntu machine using the same JDK version and the same JDBC driver, and the same JAR containing my app, it has no user-added certificates of any kind in the OpenJDK1.8 certificate store, and it can connect to the same MSSQL server using the JDBC driver with the same connection string, no problem.</p>
  <p>Why would adding an SSL certficate for an unrelated domain on the internet I connect to from my Java app, now apparently cause the MSSQL Java JDBC driver in that app to try to use a random SSL certificate from the OpenJDK1.8 cert store to connect to the local MSSQSL server on the local by-ip Class B network?</p>
  <p>Certificates were added like this:</p>
  <pre class="lang-none prettyprint-override"><code>/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/keytool -trustcacerts -keystore /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts -storepass changeit -noprompt -importcert -alias lets-encrypt-x3-cross-signed -file lets-encrypt-x3-cross-signed.der
  
  /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/keytool -trustcacerts -keystore /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts -storepass changeit -noprompt -importcert -alias lets-encrypt-x3-cross-signed2 -file isrg-root-x1-cross-signed.der
  
  /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/keytool -trustcacerts -keystore /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts -storepass changeit -noprompt -importcert -alias lets-encrypt-x3-cross-signed3 -file lets-encrypt-r3.der
  </code></pre>
  <p>EDIT: Managed to establish that the SSH certificates added above are not the problem - if I remove them from the trust store, the problem persists with JDBC connections exactly as above. The SSH certs loaded therefore has no effect on the JDBC connectivity issue e. g. that the connection attempt is returned as invalid database address.</p>