The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "Unexpected rethrowing".

Driver version

mssql-jdbc-7.1.2.jre11 mssql-jdbc-7.0.0.jre10 ( i think I got the problem with this one too)

Problem / Question

I’ve been refactoring my database connection code, and I probably have a new non-oblivious problem since but I need some pointers on what is going on in the mssql driver.

I seem to have random problems creating SQL connections that otherwise would work ok. I get the following stacktraces while connecting to a NON-ENCRYPTED sql server 2017 database.

Can someone explain the TDS Prelogin negociations vs SSL vs any other encryption scheme that might explain why I get this exception sometimes ? Or is this wrong exception message ? Is there some SSL going on to login even if we don’t have encrption setup on the sql server side ?

com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "Unexpected rethrowing".
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnection.java:2826)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1829)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:2391)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:2042)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:1889)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:1120)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:700)
        at java.sql/java.sql.DriverManager.getConnection(Unknown Source)

Caused by: javax.net.ssl.SSLProtocolException: Unexpected rethrowing
        at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1756)
        ... 41 more
Caused by: java.io.IOException: SQL Server returned an incomplete response. The connection has been closed. ClientConnectionId:b9ef7c65-28e5-4858-9cc1-642eaa2725d1
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.TDSChannel$SSLHandshakeInputStream.ensureSSLPayload(IOBuffer.java:786)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.TDSChannel$SSLHandshakeInputStream.readInternal(IOBuffer.java:836)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.TDSChannel$SSLHandshakeInputStream.read(IOBuffer.java:829)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.TDSChannel$ProxyInputStream.readInternal(IOBuffer.java:999)
        at [e-mail]11-preview/com.microsoft.sqlserver.jdbc.TDSChannel$ProxyInputStream.read(IOBuffer.java:989)
        at java.base/sun.security.ssl.SSLSocketInputRecord.read(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketInputRecord.decode(Unknown Source)
        ... 46 more

[martinm1000]

@peterbae Its the most simple one:

jdbc:sqlserver://WKS-DEV-23;encrypt=false;user=user;password=xxxxxx;applicationName=xxx;databaseName=XXXXX

by rapidly reloading data in my app I just got the exception again (even with encrypt=false which I just added).

[ulvii]

Could you use connection property sslProtocol=TLSv1 to force the driver to use TLS 1.0 and let me know if you are still seeing failures? Your connection string would become jdbc:sqlserver://WKS-DEV-23;encrypt=false;user=user;password=xxxxxx;applicationName=xxx;databaseName=XXXXX;sslProtocol=TLSv1;