InvalidAlgorithmParameterException issue in Sqoop with ssl enabled for MS SQLdatabase - hadoop

Question

I'm running Sqoop commands to import data from MS SQL with SSL enabled .
I have created the keystore and added the certificates to the keystore. I'm using Sqoop version 1.4.6-cdh5.11.2
Below is my Sqoop command :
sqoop import -Dfile.encoding=UTF-8
--driver "com.microsoft.sqlserver.jdbc.SQLServerDriver"
--connect "jdbc:sqlserver://xxxxxx:1433;databaseName=xxx-example;encrypt=True;TrustServerCertificate=False;hostNameInCertificate=xxxxxx.xxxx.net;trustStore=/home/user1/trust.jks;trustStorePassword=xxxx"
--username User1
--password 'xxxxx'
--null-string '\\N'
--null-non-string '\\N' -delete-target-dir
--target-dir "/home/john/PROGRAMS"
--table programs
--fields-terminated-by "\001"
--hive-drop-import-delims
--split-by 'ID'
--outdir 'temp/john/tables'
--bindir '/usr/john/PROGRAMS' -m 1
I've set the encryptions as true , TrustServerCertificate as false , trustStore= and trustStorePassword as the keystore password.
encrypt=True;TrustServerCertificate=False
Below is the error that i get while running the sqoop command :
18/01/22 10:12:10 INFO mapreduce.Job: Task Id : attempt_1516292804343_13212_m_000001_0, Status : FAILED
Error: java.lang.RuntimeException: java.lang.RuntimeException: com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty".
at org.apache.sqoop.mapreduce.db.DBInputFormat.setDbConf(DBInputFormat.java:170)
at org.apache.sqoop.mapreduce.db.DBInputFormat.setConf(DBInputFormat.java:161)
at org.apache.hadoop.util.ReflectionUtils.setConf(ReflectionUtils.java:73)
at org.apache.hadoop.util.ReflectionUtils.newInstance(ReflectionUtils.java:133)
at org.apache.hadoop.mapred.MapTask.runNewMapper(MapTask.java:755)
at org.apache.hadoop.mapred.MapTask.run(MapTask.java:341)
at org.apache.hadoop.mapred.YarnChild$2.run(YarnChild.java:164)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1920)
at org.apache.hadoop.mapred.YarnChild.main(YarnChild.java:158)
Caused by: java.lang.RuntimeException: com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty".
at org.apache.sqoop.mapreduce.db.DBInputFormat.getConnection(DBInputFormat.java:223)
at org.apache.sqoop.mapreduce.db.DBInputFormat.setDbConf(DBInputFormat.java:168)
... 10 more
Caused by: com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty".
at com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnection.java:1667)
at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1668)
at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:1323)
at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:991)
at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:827)
at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1012)
at java.sql.DriverManager.getConnection(DriverManager.java:664)
at java.sql.DriverManager.getConnection(DriverManager.java:247)
at org.apache.sqoop.mapreduce.db.DBConfiguration.getConnection(DBConfiguration.java:302)
at org.apache.sqoop.mapreduce.db.DBInputFormat.getConnection(DBInputFormat.java:216)
... 11 more
Caused by: javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1906)
at sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1889)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1410)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1618)
How can i solve this issue ?
I've tried adding -Djavax.net.ssl.trustStore= , but it didn't work.

Answer 1

The Microsoft doc says, For SSL to work at all, it is absolutely necessary to have the JSSE providers configured correctly for the JRE you are using. There are two steps to this:
1) Look at the java.security file in your JRE installation
(typically found in the jre\lib\security directory). The installed
security providers are listed in that file as security.provider.x=…
where ‘x’ is the priority used. For Sun JRE installations, the first
priority provider should be Sun’s. E.g.: you should have the line
“security.provider.1=sun.security.provider.Sun” in that file. For
other JRE's, please refer to the JRE's documentation regarding their
default provider name. We recommend when using the IBM JRE to specify
the "com.ibm.jsse.IBMJSSEProvider" as the first security provider to
use.
2) Next, make sure that the classpath points to the correct JAR
files (in the jre\lib directory) for use with those providers. For
Sun, the classpath should include jsse.jar. For IBM, should include
ibmjsse.jar.
Please refer this Microsoft doc that is explained by the same error you are getting (“The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error)
Looks like you have to pass the below java parameters in the sqoop job
-Djavax.net.ssl.trustStore=C:\MyCertificates\storeName
-Djavax.net.ssl.trustStorePassword=storePassword