Splunk DB Connect 3.15.0 Prod Error: "Certificates Do Not Conform to Algorithm Constraints"

Applicability

Description

Procedure leading to error:

Attempting to create or save new MSSQL connections within Splunk DB Connect 3.15.0 in a production environment.

Error message:

The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption: Error: Certificates do not conform to algorithm constraints

Investigation

• Set Java 11 as the default version in the operating system using “alternatives --config java”.
• A specific error within the search-head logs was identified, indicating a conflict between a larger key size in a self-signed certificate and the connection-saving process.
• Discovered that Java 11, by default, disables the RSA 1024 key size algorithm. If the MSSQL database utilizes a certificate with this key size, it could lead to connection issues.
• The RSA 1024 key size parameter was removed from the jdk.certpath.disabledAlgorithms setting in the java.security file, and the Splunk service was restarted. However, the issue persisted.
• RSA 1024 key size was also removed from Java 8 and the TLS algorithm.
• The operating system was rebooted, but the problem continued.
• The investigation revealed the jdk.security.legacyAlgorithms parameter in the java.security file, which by default includes RSA key size 2048. The RSA algorithm entry was removed from this parameter, followed by a Splunk service restart.

Resolution

1. Update java.security File (Path: $JAVA_HOME/lib/security/java.security) OR $JAVA_HOME/conf/security/java.security):
   • Open the java.security file 
   • Remove RSA 1024 from the jdk.certpath.disabledAlgorithms parameter.
   • Remove the RSA 1024 algorithm from the jdk.security.legacyAlgorithms parameter.
   • Remove RSA 1024 alogorithm from jdk.tls.disabledAlgorithms as well.
   • Save the changes and restart Splunk.
2. Recreate Identity:( if there is any login failure error)
   • After addressing the certificate error, recreate the identity used for the MSSQL connection within Splunk DB Connect to resolve potential login failure errors.