How to connecto DBeaver with Db2 using SSL self-signed certificate?

Question

On Db2 v11.5.7.0 Linux/x86 server I have configured SSL using self-signed certificate following official IBM documentation https://www.ibm.com/docs/en/db2/11.5?topic=transit-tls-configuration-db2

I have tested this connection on my Windows PC using CLI and connection works fine. I assume Db2 server is configured correctly to support SSL.

Now I would like to establish the same with Java application like DBeaver. On my Windows where DBeaver 22.1.3 is installed I imported SSL certificate with:

keytool -import -trustcacerts -alias myalias
  -file C:\Programs\DBeaver\db2_ssl_tls\server.arm
  -keystore C:\Programs\DBeaver\db2_ssl_tls\mynewdbclient.jks

Then I configured DBeaver connection to Db2 using SSL. I did like described in: https://selcukc.medium.com/dbeaver-create-ssl-connection-to-db2-72bd0948b6d4 or https://www.ibm.com/docs/en/fci/6.5.1?topic=application-connecting-db2-over-ssl-port like this:

When I click on Test Connection button I get error:

[jcc][t4][2030][11211][4.31.10] A communication error occurred during
operations on the connection's underlying socket, socket input stream, or
socket output stream.  Error location: Reply.fill() - socketInputStream.read
(-1).  Message: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target. ERRORCODE=-4499, SQLSTATE=08001
PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target unable to find valid certification
path to requested target unable to find valid certification path to requested
target

I have searched a lot of documentation on web, but all it seams to point to import CA certificate. But I am using self-signed certificate that does not need CA.

Questions:

1. Do I need to setup something else?
2. Does DBeaver support self-signed certificates?

Answer 1

Default DBeaver installation has the following configurations in dbeaver.ini

-vmargs
-XX:+IgnoreUnrecognizedVMOptions
--add-modules=ALL-SYSTEM
-Dosgi.requiredJavaVersion=11
-Xms64m
-Xmx1024m
-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT
-Ddbeaver.distribution.type=exe

Important is line:

-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT

This line means that DBeaver will check certificates (root and/or intermediate and/or leaf) in Windows SSL/TLS keystore.

This settings is perfect if certificate is signed by official CA or corporate CA and certificates are stored in client's Windows keystore.

But if I want to use self-signed certificate and use DBeaver's Java Key Store (instead of Windows keystore) then this settings is little pain.

Using DBeaver's Java Key Store it is required to do one of the following:

1. Remove line -Djavax.net.ssl.trustStoreType=WINDOWS-ROOT from dbeaver.ini file, because default setting is local DBeaver's keystore,
2. or change dbeaver.ini setting to: -Djavax.net.ssl.trustStoreType=jks
3. or for particular connection in DBeaver in Connection Settings | Driver Properties add parameter sslTrustStoreType with value jks.

Note settings in options 1 and 2 will be valid for all of the DBeaver's SSL/TLS connections, so this is invasive setting. Option 3 setting is setting only valid for particular SSL/TLS connection.