ERROR: "The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: 'unexpected rethrowing'" while saving a connection in Splunk DB Connect.

Available Languages

Updated:September 30, 2026

Document ID:SPLK049747

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk Enterprise Splunk DB Connect version 3.14

Description

Following an upgrade to Splunk DB Connect version 3.14 or higher, users experience SSL connection issues when interacting with MSSQL databases. The error occurs specifically when attempting to save existing connections or establish new ones using "MS Generic Drivers". The error log displays:

com.microsoft.sqlserver.jdbc.SQLServerException: "encrypt" property is set to "true" and "trustServerCertificate" property is set to "false" but the driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption: Error: Unexpected rethrowing.

Investigation

To address this issue, user need to investigate the SSL configuration, driver properties, and compatibility between the Splunk DB Connect and the MSSQL Database.

For further investigation, user must follow the steps below:

1) Ensure that the Splunk DB Connect is updated to the latest working version.

2) Attempt to save the connection again and then execute the following SPL query in the Search Head (SH):

index=_internal host=<host_name> sourcetype=dbx_server error *Unexpected* *rethrowing*

3) Verify which MS SQL driver version is being utilized during the configuration.

4) Check the MSSQL DB version and verify compatibility with the driver version.

This error occur because of an SSL protocol mismatch between the MSSQL database and the Splunk DB Connect. User needs to check the SSL version currently being used by the MSSQL database. To do that, user can contact their database team.

The older versions of the MSSQL database support TLS 1.0 and TLS 1.1, however, after Java 11 and above versions, Java disabled these protocols as part of enhanced security. The latest version of Splunk DB Connect only supports Java 11 and above versions, hence this issue arises.

To resolve this problem, users need to enable TLS 1.0 and TLS 1.1 protocols from the java.security file in the Splunk DB Connect instance.

Resolution

User can update the java.security File that resides in the path mentioned below:

Path: $JAVA_HOME/lib/security/java.security

$JAVA_HOME/conf/security/java.security

1) Open the java.security file.
2) Remove TLS1 & TLS1.1 from the jdk.certpath.disabledAlgorithms parameter.
3) RemoveT LS1 & TLS1.1 algorithm from jdk.tls.disabledAlgorithms as well.
4) Save the changes and restart Splunk.

After restarting the Splunk service, navigate to Splunk DB Connect and open the respective connection. Then, add the following JDBC parameter to the connection string:

1) For MSSQL using TLSv1: sslProtocol=TLSv1
2) For MSSQL using TLSv1.1: sslProtocol=TLSv1.1

Lastly, user should able to save the connection.

Revision History

Revision	Publish Date	Comments
1.0	30-Sep-2026	Initial Release

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)