Return
-
Title
Error "Tag Mismatch!" on DB_SQL_Server agent logs after upgrade -
Description
DB_SQL_Server agents stops monitoring SQL Server Instances after upgrading Foglight to 6.3.
Test Connection under Connection Details shows this error in the UI:
DB_SQL_Server and DB_SQL_Server_Installer agent logs show the following error message:
ERROR [ConnectionManagementThread-[MSSQLPool-SERVERHOSTNAME-INSTANCE_NAME]-[Fri Aug 04 08:53:41 CDT 2023][MSSQLProfile{host='SERVERHOSTNAME', instance= 'INSTANCE_NAME', username='.', authType= 'WINDOWS_DEFAULT', port= '0' useNTLMv2= 'true', socketTimeout= '900', database= 'master', secureConnection= 'OFF', packetSize= '0', ApplicationIntent= 'NONE', enforceSSLVersion= 'NONE', lockTimeout= '10000', codePageOverride = '', selectMethod='' }]] com.quest.qsi.fason.framework.connections.jdbc.JDBCConnectionImpl - Failed to create new connection. [MSSQLProfile{host='SERVERHOSTNAME', instance= 'INSTANCE_NAME', username='.', authType= 'WINDOWS_DEFAULT', port= '0' useNTLMv2= 'true', socketTimeout= '900', database= 'master', secureConnection= 'OFF', packetSize= '0', ApplicationIntent= 'NONE', enforceSSLVersion= 'NONE', lockTimeout= '10000', codePageOverride = '', selectMethod='' }]
com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "Tag mismatch!". ClientConnectionId:ff62f596-857e-464f-9c29-c7dc123eed72
[...]
Caused by: javax.net.ssl.SSLException: Tag mismatch!
[...]
Caused by: javax.crypto.AEADBadTagException: Tag mismatch!
Whether Use SSL is selected or not, the agent always tries to connect with SSL and generates this error.
-
Cause
-Djavax.net.debug=all reveals that the negotiated TLS protocol version selected is TSLv1.3.
ServerHello.java:955|Negotiated protocol version: TLSv1.3
TLS version 1.3 is not supported by Windows Server 2019 at the time of this writing. The target server requested the TLS version to be 1.3, but the cause was indeterminate.
Microsoft JDBC driver will always try to use SSL even if encrypt is set to false. -
Resolution
Very similar workarounds as in KB 4310338, but instead of removing protocols, we'll add TLSv1.3 to the list of disabled protocolsWORKAROUND
Edit the value in the java.security file directly.
- Navigate to the the Java.Security file location on the Foglight Agent Manager (FglAM)
- On an external Fglam this would be {fglam}\jre\{version}lib\security\
- Using an embedded FglAM this would be {fms}\jre\lib\security\
- Open the file java.security in a text editor
- Search for the property jdk.tls.disabledAlgorithms
- For OpenJDK 8, the contents would be similar to
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL \
include jdk.disabled.namedCurves - Add TLSv1.3 to the list of entries, this will prevent the JRE to offer this protocol version to the target server
- Save the file
- Restart the Foglight Agent Manager
- Navigate to the the Java.Security file location on the Foglight Agent Manager (FglAM)