opened
2019-05-10
username_0
In 7.3.0 a connection to PostgreSQL 12 with SSL (org.postgresql.ssl.DefaultJavaSSLFactory) works.
After upgrade to 7.3.2 the very same connection fails with
```
SSL error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    unable to find valid certification path to requested target
```

Downgrading to 7.3.0 and the connection works again.
```
!ENTRY org.jkiss.dbeaver.model 4 0 2021-01-07 17:20:50.612
!MESSAGE unable to find valid certification path to requested target
!SUBENTRY 1 org.jkiss.dbeaver.model 4 0 2021-01-07 17:20:50.612
!MESSAGE unable to find valid certification path to requested target
!STACK 0
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.base/java.security.cert.CertPathBuilder.build(Unknown Source)
at java.base/sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at java.base/sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at java.base/sun.security.validator.Validator.validate(Unknown Source)
at java.base/sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(Unknown Source)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(Unknown Source)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(Unknown Source)
at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:40)
at org.postgresql.core.v3.ConnectionFactoryImpl.enableSSL(ConnectionFactoryImpl.java:435)
at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:94)
at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192)
at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49)
at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195)
at org.postgresql.Driver.makeConnection(Driver.java:454)
at org.postgresql.Driver.access$100(Driver.java:57)
at org.postgresql.Driver$ConnectThread.run(Driver.java:364)
at java.base/java.lang.Thread.run(Unknown Source)
```
SSL-Connection broken after upgrade 7.3.0 -> 7.3.2
issue
created
kseniiaguzeeva
username_1
Cannot reproduce, Which settings do you do in SSL tab for the connection?
![dbeaver_4HR98gMTY5](https://user-images.githubusercontent.com/51405061/103983973-57ce9500-5197-11eb-8197-2f003a30450e.png)
Can you also send log files https://github.com/dbeaver/dbeaver/wiki/Log-files? (here or on kseniia@jkiss.org)
comment
created
serge-rider
username_2
@username_0 Do you have SSL certificates configured in default Java installation? Since version 7.3.1 all DBeaver installers contain Java inside, default Java installed in your system not used anymore.

So you need tocnfigure SSL in DBeaver itself (by specifying certificate files) but not in Java (using keytool).
comment
created
2019-05-10
username_0
What's the rationale behind this?
It basically means that there's a Java installation I didn't consent to and don't even necessarily know about, which takes up additional space and is not updated together with the installations I installed on my own and know about, thus being a potential security issue.

For the moment I was able to fix that by prepending
```
-vm
/usr/bin
```
to
```
dbeaver.ini
```
but with the next update that will be gone again.
Is there a way to tell DBeaver to use a JRE _I_ want it to instead of a bundled one I have no control over?
comment
created
serge-rider
username_2
Most DBeaver users don't know what Java is and don't know how install it. Also DBeaver needs proper Java version and installing proper Java may be tricky. We shipped DBeaver for Windows and MacOS along with Java bundle for years. Now we decided to include it into Linux distributions as well.

And yes, you will need to fix configuration i nthe next version. That's inconvenient.

Probably we need to create new DBeaver download "without JDK included". It may be more preferable by more experienced users. 

I've crete the ticket  (#10904) for this.
comment
closed
uslss
username_3
issue