DBCPConnectionPool 1.28.1 : Cannot create PoolableConnectionFactory (Certificates do not conform to algorithm constraints.)

[#1]

Hello!

I have a NiFi 1.28 instance running on a Oracle Linux Server 9.6. I'm trying to connect to a Microsoft SQL Server database using a DBCPConnectionPool 1.28.1 controller, with a mssql-jdbc-13.2.1.jre11.jar driver, but I'm getting a very confusing error:

Failed to establish Database Connection: java.sql.SQLException: Cannot create PoolableConnectionFactory ("encrypt" property is set to "false" and "trustServerCertificate" property is set to "true" but the driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption: Error: Certificates do not conform to algorithm constraints.

Here is what I've already tried to fix this error:

- Import the self signed certificate (from the database machine) into the $JAVA_HOME truststore
- change the default cypto policy with: 

update-crypto-policies --set DEFAULT:SHA1

- Relax the java security restrictions by going into the java.security file and commenting the jdk.certpath.disabledAlgorithms and jdk.tls.disabledAlgorithms properties

- Tried accessing the database itself within the machine's terminal, which works just fine (so it is a NiFi issue)

- Tried connecting with the properties encrypt=false;trustServerCertificate=true; on the connection string and all of it's 3 variations (true/true, true/false and false/false)

Is this a known issue or am I missing a configuration? Any help is appreciated and I'm down to answering any questions to help solve this issue. Thank you very much.

[#2]

Hello @enguias, 

Sometimes this error could be for an old algorithm such as SHA-1. And most possible if using Java 11 that is more strict with the policies. 

One option is to use connection without TLS, if possible and acceptable in your environment: 

jdbc:sqlserver://<host>:<port>;databaseName=<DB>;encrypt=disable

Or, update the certificate to SHA-256 with TLS 1.2. 
This is the best option if you prefer to maintain the encryption. 
Maybe this documentation from SQL can help too: 
https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-sql-server-encrypt...