websphere + SSLv3 SSLContext not available

Question

I have a java application that is using hibernate to do a JNDI lookup for the datasource in Websphere Application Server which then talks to a MSSQL database.

The security team has recently patched the Websphere server 8.5.5.4 to disable SSLv3.

As such I'm getting a com.ibm.websphere.ce.cm.StaleConnectionException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encyption. Error: "SSLv3 SSLContext not available".

Before this, I could access the data without any issues.

What can I do to overcome this issue? Do I need to configure the application to use TLS?

I'm using Hibernate 4.3.7.

The hibernate config looks like this.

<hibernate-configuration>
    <session-factory>
    <property name="hibernate.connection.driver_class">net.sourceforge.jtds.jdbc.Driver</property>
    <property name="connection.datasource">jdbc/testing</property>
    <property name="hibernate.dialect">org.hibernate.dialect.SQLServerDialect</property>
    <mapping resource="myApplication.hbm.xml" />
    </session-factory>
</hibernate-configuration>

Any help would be greatly appreciated.

Thanks for all your reply. Updating sqljdbc4.jar seems to have done the trick. Looking good. — Coola, Feb 18 '15 at 22:35

trikelef · Answer 1 · 2015-02-18T12:50:47.977

1

Maybe you should look at the MSSQL side to check whether TLS (at least 1.0 version) is supported. If not try to enable it.

Otherwise a (not recommended from security view) fix is to enable SSLv3 temporarily by using the following JVM argument until you find a way to communicate through TLS:

-Dcom.ibm.jsse2.disableSSLv3=false

edited Feb 18 '15 at 12:50

answered Feb 18 '15 at 09:35

trikelef

2,192
1
22
39

score 1 · Answer 2 · answered Feb 18 '15 at 09:44

1

I have this issue yesterday.

I solved it by using sqljdbc4.jar instead of sqljdbc4.1 and it works fine.

answered Feb 18 '15 at 09:44

Jay Sithiporn

91
5
14

score 0 · Answer 3 · answered Feb 18 '15 at 10:29

0

I found a solution. Try updating your sqljdbc4.jar file - it turns out mine was outdated. Alternatively, I also got it running with the solution by @trikelef that enables SSLv3 - but this opens security issues.

answered Feb 18 '15 at 10:29

Petar

51
1
7

I upgraded to this version and it resolved my issue. http://www.java2s.com/Code/JarDownload/sqljdbc4/sqljdbc4-3.0.jar.zip – cwash Mar 03 '16 at 16:32

websphere + SSLv3 SSLContext not available

3 Answers3