Trying to enable encryption to sql database
Asked by Socko-71:

**I'm trying to get the Confluence database connection to use encryption: My current setting is: \<property name="hibernate.connection.url"\>jdbc:jtds:sqlserver://xx-xxxx-dev.xxxxxxxxxxxx.com:49666/confluencedev_db;secure=true;useSSL=true;requireSSL\</property\> I have setup other connections on other apps using this connection:**

**jdbc.url=jdbc:sqlserver://xx-xxxx-dev.xxxxxxxxxxxx.com:49666;databaseName=BitBucket;instance=secure;encrypt=true;trustServerCertificate=true; This works just fine..any idea on the Confluence?**


Answers:
author: AnnWorley
body: It's a known issue:
> Oracle introduced a security fix for the SSL/TLS BEAST attack that is known to interfere with Microsoft JDBC/jTDS connections....
>
> Official Bug Report:
>
> <https://bugs.openjdk.java.net/browse/JDK-8014272>

To be able to connect to MS SQL securely you will have to disable the fix for the SSL/TLS BEAST attack, and hence, the DB server will be vulnerable to this type of attack. The instructions are described on [Cannot Connect Confluence to MS SQL Server Using Force Encryption](https://confluence.atlassian.com/confkb/cannot-connect-confluence-to-ms-sql-server-using-force-encryption-591594220.html)

comments: author: Socko-71
body: Thanks for the reply but unfortunately the article refereed to the setenv.bat to look for the java options (java_opts). Our setenv.bat uses CATALINA_OPTS instead.

Thanks


author: AnnWorley
body: Hopefully you are installing Confluence as a service, in which case the catalina options are passed via the service rather than the setenv.bat. When Confluence starts as a service the parameters in sertenv.bat are ignored. This document has screen shots showing how to set the system properties for the Windows service: [Windows service](https://confluence.atlassian.com/doc/configuring-system-properties-168002854.html#ConfiguringSystemProperties-Windowsservice)

Thank you for pointing out the oversight of the doc that fails to mention that CATALINA_OPTS have been used since Confluence 5.5. I will work on editing it.


author: Socko-71
body: No thanks you for just a fast response. I forwarded the link to our server team. I will let you know if it fixed my issue.

Thanks


author: AnnWorley
body: I look forward to your update with high hopes.


author: Socko-71
body: Well poo, with the options: confluencedev_db;secure=true;useSSL=true;requireSSL I get database connects but not encrypted and checking the log file I still get the "SQLException: I/O Error: DB server closed connection..etc..". Using confluencedev_db;SSL=true I loose the data connections but still get the "SQLException: I/O Error: DB server closed connection..etc.." in the log file... :)


author: AnnWorley
body: Hi Bob,

Please set the system property;

```
 -Djsse.enableCBCProtection=false
```

for the Confluence service, following: [Cannot Connect Confluence to MS SQL Server Using Force Encryption](https://confluence.atlassian.com/confkb/cannot-connect-confluence-to-ms-sql-server-using-force-encryption-591594220.html)

Please make sure your JDBC URL is like this:

```
jdbc:jtds:sqlserver://YourDatabaseServer:1433/YourConfluenceDatabase;ssl=true
```

Thanks,

Ann


author: Socko-71
body: ```
-Djsse.enableCBCProtection=false (was previously set)
```

Change line in confluence.cfg.xml from:confluencedev_db;secure=true;useSSL=true;requireSSL

to: confluencedev_db;SSL=true

Still getting (first few lines of log)

HelperThread-#1\] \[mchange.v2.resourcepool.BasicResourcePool\] log com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask@4ae93aea -- Acquisition Attempt Failed!!! Clearing pending acquires. While trying to acquire a needed new resource, we failed to succeed more than the maximum number of allowed acquisition attempts (30). Last acquisition attempt exception:  
java.sql.SQLException: I/O Error: DB server closed connection.  
at net.sourceforge.jtds.jdbc.TdsCore.nextToken(TdsCore.java:2481)  
at net.sourceforge.jtds.jdbc.TdsCore.login(TdsCore.java:632)  
at net.sourceforge.jtds.jdbc.JtdsConnection.\<init\>(JtdsConnection.java:371)  
at net.sourceforge.jtds.jdbc.Driver.connect(Driver.java:184)  
at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:175)  
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection


author: AnnWorley
body: Hi Bob,

I opened a support request so we could use the file sharing feature of the portal to take a closer look. Please watch your inbox for a notification of the ticket.

When we sort this out we can circle back and let the Community know the resolution.

Thanks,

Ann