5051 ERROR_DB_UNAVAILABLE

[Tyler Johnson]

I'm running pwm-1.8.0 on Ubuntu 16.04 with a mysql 5.7.33 localdb pointing to Active Directory. The system has been running fine for over a year. I recently rebooted after updating certs for tomcat as they had expired and when tomcat came back up after I attempted to log in I receive the following error: 

"Database Unavailable. If this error occurs repeatedly please contact your help desk. { 5051 ERROR_DB_UNAVAILABLE (unable to initialize database: exception initializing database service: 5051 ERROR_DB_UNAVAILABLE (error connecting to database: com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: Communications link failure

The last packet successfully received from the server was 1 milliseconds ago. The last packet sent successfully to the server was 0 milliseconds ago., cause:javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate))) }"

The database is up and listening. I'm able to use mysql to connect with the root and pwm users. The mysql error log just shows " [Note] Bad handshake". 

[Tyler Johnson]

The issue stemmed from a java update, I edited the jdk.tls.disabledAlgorithms value in the java.security file and everything worked. 

[Brice Fayd'herbe]

Hello,

Came across the same issue when updating my Ubuntu 16.04 to 16.08. What did you edit exactly in the java.security file ?

Here is mine :

#jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \

    DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \

    include jdk.disabled.namedCurves

Thank !

Brice

[Brice Fayd'herbe]

Meant 16.04 to 18.04.5

[Brice Fayd'herbe]

Guys, found a solution :

Just edit your Database Connection string and add : ?enabledTLSProtocols=TLSv1.2.

Working !

[Aaron Moreno]

Just ran into this with the docker image, which is odd, because it has been working fine since I started implementation about a month ago. v1.9.2. Updating the connection string to include the ?enabledTLSProtocols=TLSv1.2 worked.