Why can Java not connect to MySQL 5.7 after the latest JDK update and how should it be fixed? (ssl.SSLHandshakeException: No appropriate protocol)

Question

In the latest update to the JDK in April 2021 (11.0.11+9-0ubuntu2~18.04) support for TLSv1 and TLSv1.1 was dropped, presumably because since March 2021 those versions are no longer supported. This is evident by the diff in the java.security file:

Before:

jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \
    EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
    include jdk.disabled.namedCurves

After:

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
    DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
    include jdk.disabled.namedCurves

which is also discussed in this SO post: SSLHandShakeException No Appropriate Protocol . In that thread there are also more answers popping up the last few days since the updated JDK version.

After this update of the JDK, we received the error

java.sql.SQLException: An attempt by a client to checkout a Connection has timed out.

with c3p0.

After switching to hikari we got a more meaningful error:

ERROR [2021-04-29 16:21:16,426] com.zaxxer.hikari.pool.HikariPool: HikariPool-1 - Exception during pool initialization.
! javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)

We're running on MySQL 5.7.33-0ubuntu0.18.04.1. Now in my understanding as described here, MySQL 5.7 supports TLSv1.2. Also when running SHOW VARIABLES LIKE 'tls_version'; we get TLSv1,TLSv1.1,TLSv1.2 which suggest that TLSv1.2 is supported.

So then the question is, why don't the JDK and MySQL just agree on using TLSv1.2 and what can we do about it, to make them communicate with TLSv1.2?

Note: I don't think changing the java.security file as suggested in the other thread is a good long term solution to this problem!

Answer 1

As @skelwa already commented you will need to add the enabledTLSProtocols=TLSv1.2 configuration property in the connection string to resolve your issue.

A complete connection string for Connector/J could look like this:

jdbc:mysql://<host>:<port>/<dbname>?enabledTLSProtocols=TLSv1.2

For r2dbc you will need to use tlsVersion=TLSv1.2 instead.

For Connector/J v8.0.28 enabledTLSProtocols was renamed to tlsVersions (see note). However, the original name remains as an alias.

---

The question that remains is:

Why don't the JDK and MySQL just agree on using TLSv1.2?

Although both parties do actually support TLSv1.2, the problem you were experiencing is introduced by the default behavior of Connector/J. For compatibility reasons Connector/J does not enable TLSv1.2 and higher by default. Therefore, one has to enable it explicitly.

See the following note:

For Connector/J 8.0.18 and earlier when connecting to MySQL Community Server 5.6 and 5.7 using the JDBC API: Due to compatibility issues with MySQL Server compiled with yaSSL, Connector/J does not enable connections with TLSv1.2 and higher by default. When connecting to servers that restrict connections to use those higher TLS versions, enable them explicitly by setting the Connector/J connection property enabledTLSProtocols (e.g., set enabledTLSProtocols=TLSv1,TLSv1.1,TLSv1.2).

---

WARNING: please be aware that solutions suggesting editing jdk.tls.disabledAlgorithms inside of jre/lib/security pose a security risk to your application and changing anything there might have severe implications! There are reasons why those protocols were disabled and one should not simply remove everything or even just parts from that list.

---

Note: if you want to get more low level insights from the JDK to debug your problem you can enable ssl debug logs by passing the following configuration to the java comand:

-Djavax.net.debug=ssl,handshake or even -Djavax.net.debug=all

In your case you will see something like:

...(HANDSHAKE_FAILURE): Couldn't kickstart handshaking (
"throwable" : {
  javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
    at java.base/sun.security.ssl.HandshakeContext.<init>(HandshakeContext.java:170)
    at java.base/sun.security.ssl.ClientHandshakeContext.<init>(ClientHandshakeContext.java:98)
    ...

Answer 2

I just added useSSL=false and it worked for me.

jdbc:mysql://<host>:<port>/<dbname>?useSSL=false

I have JDK 8, MySQL 5.7 and mysql-connector-java lib with version 5.1.38

This is useful when you want to execute quickly in local environment only (not recommended for staging/test/prod)

Answer 3

I came here because I had the same issue, but unfortunately,

jdbc:mysql://host:port/dbname?enabledTLSProtocols=TLSv1.2

didn't work for me because I'm using r2dbc. After a little bit of debugging I found out the name of the parameter must be tlsVersion instead, so you can use, for example:

spring.r2dbc.url=r2dbc:mysql://host:port/dname?tlsVersion=TLSv1.2

Answer 4

I faced this issue due to the older version of mysql-connector-java-5.1.40-bin.jar & OpenJDK 1.8 version, After Upgrading to the 5.1.49 version solved my issue

Answer 5

This is not a StreamSets issue. This is a compatibility issue between Java and the MySQL JDBC driver

Choose the most appropriate solution from below for your situation Solution #1: Add "enabledTLSProtocols=TLSv1.2" to JDBC connection string Verify MySQL supports TLSv1.2

mysql> show variables like 'tls_version';
+---------------+---------------------+
| Variable_name | Value |
+---------------+---------------------+
| tls_version | TLSv1,TLSv1.1,TLSv1.2 |
+---------------+---------------------+
1 row in set (0.00 sec)

Update JDBC connection string

jdbc:mysql://[hostname]:[port]/[databaseName]?enabledTLSProtocols=TLSv1.2

Solution #2: Enable TLSv1 and TLSv1.1 File: $JAVA_HOME/jre/lib/security/java.security Old configuration: jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA,
DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL New configuration: jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024,
EC keySize < 224, 3DES_EDE_CBC, anon, NULL

Solution #3: Upgrade the MySQL database The TLS version is automatically selected by the JDBC driver depending on the database version.

TLSv1 and TLSv1.1 will be used for versions below: 8.0, 5.7.28, 5.6.46

Additional Information A recent Java update, specifically Red Hat/CentOS, disables TLSv1 and TLSv1.1 by default for Java 8

The MySQL JDBC driver will attempt to use TLSv1 and/or TLSv1.1 if the MySQL database version is below one of the following: 8.0, 5.7.28, 5.6.46

Answer 6

If possible, the better solution should be to upgrade to one of the following releases of Connector/J:

• 8.0.19, released on 2020-01-13, the release notes for which say:

The allowable versions of TLS protocol used for connecting to the server, when no restrictions have been set using the connection properties enabledTLSProtocols, have been changed to:

• TLSv1, TLSv1.1, TLSv1.2, and TLSv1.3 for MySQL Community Servers 8.0, 5.7.28 and later, and 5.6.46 and later, and for all commercial versions of MySQL Servers.
• TLSv1 and TLSv1.1 for all other versions of MySQL Servers.

or

• 5.1.49, released 2020-04-29, the release notes for which say:

The allowable versions of TLS protocol used for connecting to the server, when no restrictions have been set using the connection properties enabledTLSProtocols, have been changed to:

• TLSv1, TLSv1.1, and TLSv1.2 for MySQL Community Servers 8.0, 5.7.28 and later, and 5.6.46 and later, and for commercial versions of MySQL Server 5.6, 5.7, and 8.0.
• TLSv1 and TLSv1.1 for all other versions of MySQL Servers.

If that's not possible, you could consider upgrading your MySQL servers to 8.0.x, which some older versions of Connector/J will use TLSv1.2 to where they won't enable it when connecting to 5.7.x.

If you can't upgrade either (yet), then changing enabledTLSProtocols would obviously be necessary.

Answer 7

You can do the following steps:

1. Open java.security file. (It is under jre/lib/security folder)
2. Find the following line : jdk.tls.disabledAlgorithms
3. Comment that complete line.

After this try running and it should work.

Or if you want only specific algorithm remove it from disabled list.

You can send it in config and comment that in java.security file

jdbc:mysql://<host>:<port>/<dbname>?enabledTLSProtocols=TLSv1.2