Enabling Java ciphers for database connection

Products

• CA Test Data Manager (Data Finder / Grid Tools)

Issue/Introduction

You were unable to establish a connection profile to a database. While network connectivity was confirmed, the TDM logs showed a javax.net.ssl.SSLHandshakeException (specifically, handshake_failure). Investigation revealed that the newer Java (JDK 21) version included in the TDM deployment disabled the specific legacy cipher required by the database: TLS_RSA_WITH_AES_128_GCM_SHA256

Example of log:

[ERROR] [https-jsse-nio-8443-exec-3] --- [U:###][M:POST][P:/api/ca/v1/connectionProfiles/### with ssl/actions/validate
]            c.c.t.c.d.s.TDMDriverManagerDataSource:  Error during opening connection: null
javax.net.ssl.SSLHandshakeException: (handshake_failure) Received fatal alert: handshake_failure
...

Environment

TDM docker portal 5.0.66.0 with helm chart 5.0.13

Cause

TDM pods run on a version of Java(openjdk version "21.0.11" 2026-04-21 LTS) that disables certain weak TLS ciphers by default (specifically TLS_RSA_* ciphers) via the java.security configuration file. The DB environment relied on these legacy ciphers, leading to the handshake failure during SSL validation.

The default setting in java.security file:

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, DTLSv1.0, RC4, DES, \
   MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
   ECDH, TLS_RSA_*, rsa_pkcs1_sha1 usage HandshakeSignature, \
   ecdsa_sha1 usage HandshakeSignature, dsa_sha1 usage HandshakeSignature

Resolution

The issue was resolved by providing the ability to inject a custom security properties file into the TDM deployment.

1. Configuration: A custom.java.security file was created and mounted under the shared folder path (/home/tdm/.tdm/conf/custom.java.security).
2. Security Policy Customization: In this case, the custom file was configured to selectively remove the restrictions on the TLS_RSA_* ciphers while maintaining other default security settings. i.e. just remove TLS_RSA_* from the default jdk.tls.disabledAlgorithms property, but keep the others.
   Example of custom.java.security file:
   

   $ cat /home/tdm/.tdm/conf/custom.java.security
   jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, DTLSv1.0, RC4, DES, \
       MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
       ECDH,  rsa_pkcs1_sha1 usage HandshakeSignature, \
       ecdsa_sha1 usage HandshakeSignature, dsa_sha1 usage HandshakeSignature

3. Specify custom java security file in values.yaml file: 
   A new global.ssl.securityProperties introduced from helm chart 5.0.69.
   For example:
   

   global:
     platform: ""
     ssl:
       securityProperties: "custom.java.security"
   ...

4. Update Deployment: Re-deploy TDM with new Helm chart version 5.0.69 or above, which supports a custom java security file.
5. Verification: "Test" connection with the TDM connection profile connecting to the DB instance.

 

Note:

• Only need to put the properties you want to customize in the custom security file.
• The change in custom security file will apply to all TDM java pods.