Cannot Connect Confluence to MS SQL Server Using Force Encryption
Platform Notice: Data Center - This article applies to Atlassian products on the Data Center platform.
Note that this knowledge base article was created for the Data Center version of the product. Data Center knowledge base articles for non-Data Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Symptoms
During the initial setup of Confluence, the database setup step will fail with the following error in the UI:
You will also see the following in the atlassian-confluence.log:
2014-05-05 11:36:42,440 WARN [com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread-#2] [mchange.v2.resourcepool.BasicResourcePool] run com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@716cb856 -- Acquisition Attempt Failed!!! Clearing pending acquires. While trying to acquire a needed new resource, we failed to succeed more than the maximum number of allowed acquisition attempts (30). Last acquisition attempt exception:
java.sql.SQLException: I/O Error: DB server closed connection.
at net.sourceforge.jtds.jdbc.TdsCore.nextToken(TdsCore.java:2307)
at net.sourceforge.jtds.jdbc.TdsCore.login(TdsCore.java:602)
at net.sourceforge.jtds.jdbc.ConnectionJDBC2.<init>(ConnectionJDBC2.java:344)
at net.sourceforge.jtds.jdbc.ConnectionJDBC3.<init>(ConnectionJDBC3.java:50)
at net.sourceforge.jtds.jdbc.Driver.connect(Driver.java:182)
at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:134)
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:182)
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:171)
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:137)
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1014)
at com.mchange.v2.resourcepool.BasicResourcePool.access$800(BasicResourcePool.java:32)
at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1810)
at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:547)
Caused by: java.io.IOException: DB server closed connection.
at net.sourceforge.jtds.jdbc.SharedSocket.readPacket(SharedSocket.java:843)
at net.sourceforge.jtds.jdbc.SharedSocket.getNetPacket(SharedSocket.java:722)
at net.sourceforge.jtds.jdbc.ResponseStream.getPacket(ResponseStream.java:466)
at net.sourceforge.jtds.jdbc.ResponseStream.read(ResponseStream.java:103)
at net.sourceforge.jtds.jdbc.TdsCore.nextToken(TdsCore.java:2202)Cause
Oracle introduced a security fix for the SSL/TLS BEAST attack that is known to interfere with Microsoft JDBC/jTDS connections. Confluence is unable to acquire a connection against MS SQL Server.
Official Bug Report:
https://bugs.openjdk.java.net/browse/JDK-8014272
Resolution
Attention
Atlassian applications allow the use of SSL within our products, however Atlassian Support does not provide assistance for configuring it. Consequently, Atlassian can not guarantee providing any support for it.
- If assistance with conversions of certificates is required, please consult with the vendor who provided the certificate.
- If assistance with configuration is required, please raise a question on the Atlassian Community.
- To be able to connect to MS SQL you will have to disable the fix for the SSL/TLS BEAST attack, and hence, the DB server will be vulnerable to this type of attack.
The JTDS 1.3.1.jar driver embedded with Confluence contains a bug and does not allow connection to an encrypted MSSQL when using JAVA 1.8. See here for the bug details. You'll need to download the patched JTDS 1.3.1 driver file in order to connect to an SSL encrypted MSSQL database.
Stop Confluence.
In your <Confluence Install>/bin open the setenv.bat file for windows or setenv.sh for linux.
Search for CATALINA_OPTS (JAVA_OPTS for Confluence 5.5 or below) and include below parameter in the end of the line:
Parameter-Djsse.enableCBCProtection=falseIf you are starting Confluence as a windows service please follow this guide to add the parameter of step 3 instead of running step 2.
- Once you are done start Confluence.
During Confluence installation add "?ssl=true" after the jdbc connection string, the URL will look similar to below one:
jdbc:jtds:sqlserver://YourConfluenceServer:1433/YourConfluenceDatabase?ssl=true*Note that the "?" demarcates the end of the database name and the beginning of the database connection parameters. If you already have connection parameters, you will add a ";ssl=true" instead of "?ssl=true".
Finish the initial setup.
For Crowd products, if the above workaround does not help, please try switching the bundled JTDS driver to MSSQL driver as described on: