1

On Db2 v11.5.7.0 Linux/x86 server I have configured SSL using self-signed certificate following official IBM documentation https://www.ibm.com/docs/en/db2/11.5?topic=transit-tls-configuration-db2

I have tested this connection on my Windows PC using CLI and connection works fine. I assume Db2 server is configured correctly to support SSL.

Now I would like to establish the same with Java application like DBeaver. On my Windows where DBeaver 22.1.3 is installed I imported SSL certificate with:

keytool -import -trustcacerts -alias myalias
  -file C:\Programs\DBeaver\db2_ssl_tls\server.arm
  -keystore C:\Programs\DBeaver\db2_ssl_tls\mynewdbclient.jks

Then I configured DBeaver connection to Db2 using SSL. I did like described in: https://selcukc.medium.com/dbeaver-create-ssl-connection-to-db2-72bd0948b6d4 or https://www.ibm.com/docs/en/fci/6.5.1?topic=application-connecting-db2-over-ssl-port like this: enter image description here

When I click on Test Connection button I get error:

[jcc][t4][2030][11211][4.31.10] A communication error occurred during
operations on the connection's underlying socket, socket input stream, or
socket output stream.  Error location: Reply.fill() - socketInputStream.read
(-1).  Message: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target. ERRORCODE=-4499, SQLSTATE=08001
PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target unable to find valid certification
path to requested target unable to find valid certification path to requested
target

I have searched a lot of documentation on web, but all it seams to point to import CA certificate. But I am using self-signed certificate that does not need CA.

Questions:

  1. Do I need to setup something else?
  2. Does DBeaver support self-signed certificates?
1
  • "self-signed certificate that does not need CA" -- that's not true. You still need to add the signer certificate to the trust store.
    – mustaccio
    Aug 7, 2022 at 11:33

1 Answer 1

2

Default DBeaver installation has the following configurations in dbeaver.ini

-vmargs
-XX:+IgnoreUnrecognizedVMOptions
--add-modules=ALL-SYSTEM
-Dosgi.requiredJavaVersion=11
-Xms64m
-Xmx1024m
-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT
-Ddbeaver.distribution.type=exe

Important is line:

-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT

This line means that DBeaver will check certificates (root and/or intermediate and/or leaf) in Windows SSL/TLS keystore.

This settings is perfect if certificate is signed by official CA or corporate CA and certificates are stored in client's Windows keystore.

But if I want to use self-signed certificate and use DBeaver's Java Key Store (instead of Windows keystore) then this settings is little pain.

Using DBeaver's Java Key Store it is required to do one of the following:

  1. Remove line -Djavax.net.ssl.trustStoreType=WINDOWS-ROOT from dbeaver.ini file, because default setting is local DBeaver's keystore,
  2. or change dbeaver.ini setting to: -Djavax.net.ssl.trustStoreType=jks
  3. or for particular connection in DBeaver in Connection Settings | Driver Properties add parameter sslTrustStoreType with value jks.

Note settings in options 1 and 2 will be valid for all of the DBeaver's SSL/TLS connections, so this is invasive setting. Option 3 setting is setting only valid for particular SSL/TLS connection.

2
  • In my case I had to put -Djavax.net.ssl.trustStoreType=WINDOWS-ROOT back. Now it's working. Jan 23, 2023 at 11:44
  • In DBeaver v22.2.0 setting was removed from dbeaver.ini and GUI option was added. See menu Window | Preferences. On Connection tab there is Security section and by default it is checked "Use Windows trust store". This settings is also available in currently the latest version of DBeaver 22.3.3.
    – folow
    Jan 24, 2023 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.