DB Connect cannot initiate task server on RHEL 8 with FIPS enabled

Applicability

Splunk Apps and Add-ons Splunk App for DB Connect

Description

While trying to configure the settings for DB Connect the task server will not start. The splunkd.log file shows:

01-06-2022 21:34:54.528 +0000 ERROR ExecProcessor [129654 ExecProcessor] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/linux_x86_64/bin/server.sh" 21:34:54.527 [main] ERROR com.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_failed

01-06-2022 21:34:54.528 +0000 ERROR ExecProcessor [129654 ExecProcessor] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/linux_x86_64/bin/server.sh" java.security.KeyStoreException: FIPS mode: KeyStore must be from provider SunPKCS11-NSS-FIPS

Note:
It may work right away in RHEL 7 with FIPS enabled.

Investigation

The issue is related to the following RHEL 8 known issue, where The Java keytool does not find any keys in a Java keystore when FIPS mode is enabled.

This issue can be reproduced by: 
1. Enabling FIPS mode on system and reboot.
2. After logging back in, download attached keystore file.
3. Run command "keytool -list -v -keystore ./AmazonCAs.jks"

Actual results: System reports the keystore containing 0 entries.
Expected results: System prints out contents of keyfile.

Additional info:

• This seems to also be an issue with u302, though reproducibility is less certain there.
• Deactivating FIPS mode seems to work around the issue.
• This issue seems to affect any keystore file.

 

Resolution

Added "-Djava.security.disableSystemPropertiesFile=true" to both "Task Server JVM Options" & "Query Server JVM Options" and saved the settings in the UI.

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release