Skip to main content
Question

Database connection unsuccessful: Failed to connect - What certificate is it using?

  • March 11, 2025
  • 67 replies
  • 186 views

Shawn Cannon
Forum|alt.badge.img+1

Hey I am trying to create a database connection to an MS SQL server. When I test the connection, I get the following error:Database connection unsuccessful: Failed to connect to x.x.x.x:1433 - self signed certificateI assume that means that Cribl Stream tries to make an encrypted connection to the SQL database? If so, what certificate is it using? Is there a way to force not using a cert if I wanted to test it that way? Nothing in the connection settings has a place for certificate information.

67 replies

Forum|alt.badge.img
  • Participating Frequently
  • March 11, 2025

I assume Cribl is not using the cert, but the database server is using a self signed cert on its side. Did you check that?


Shawn Cannon
Forum|alt.badge.img+1
  • Author
  • Inspiring
  • March 11, 2025

outside of Cribl


Shawn Cannon
Forum|alt.badge.img+1
  • Author
  • Inspiring
  • March 11, 2025

I dont think other connections are using a secure method to connect to the SQL server. I will have to do some more testing to be sure though.


Forum|alt.badge.img
  • Participating Frequently
  • March 11, 2025

Are you using a connection string in your database connection setting Cribl? Can you share that page?


That error is always due to a client encountering a server cert it doesn't trust. A client doesn't have to have its own cert in order to make an encrypted connection (eg your web browser doesn't need its own certificate to use https with any website). Having its own certificate only provides authentication for clients. We would need to see your connection string to troubleshoot further.


David Maislin

Are you using a hostname or an ip for the connection?


Shawn Cannon
Forum|alt.badge.img+1
  • Author
  • Inspiring
  • March 11, 2025

IP


Shawn Cannon
Forum|alt.badge.img+1
  • Author
  • Inspiring
  • March 11, 2025

I can post connection string


David Maislin

Just for a test, can you edit your hosts file in the event it isn't in DNS and give it a name that matches your cert host name?


Shawn Cannon
Forum|alt.badge.img+1
  • Author
  • Inspiring
  • March 11, 2025

obviously IP is different


Forum|alt.badge.img
  • Participating Frequently
  • March 11, 2025

You could try adding ;TrustServerCertificate=True


Forum|alt.badge.img
  • Participating Frequently
  • March 11, 2025

Thats obviously a dirty fix


Shawn Cannon
Forum|alt.badge.img+1
  • Author
  • Inspiring
  • March 11, 2025

so add a HOSTS entry for that IP, mapping it to name? yeah that line is worth a shot as well.So when creating the database collector, what is the proper format for the query? I pop in a normal SQL query and it does not like that


David Maislin

Same!


Forum|alt.badge.img
  • Participating Frequently
  • March 11, 2025

You're now in Microsoft country, I'm out :grin:


Shawn Cannon
Forum|alt.badge.img+1
  • Author
  • Inspiring
  • March 11, 2025

LOL


Shawn Cannon
Forum|alt.badge.img+1
  • Author
  • Inspiring
  • March 11, 2025

oh well, guess i will give up on database collectors.


<@U02MJ3E1B2P&gt; did you get windows auth working in your lab or was the conclusion that it's not yet supported ?


<@U02B3KG124C&gt; any guidance here?


David Maislin

Just checking for the obvious, did you add single quotes around your connection string?


I don't think it allows saving if they string is invalid.


Shawn Cannon
Forum|alt.badge.img+1
  • Author
  • Inspiring
  • March 11, 2025

the docs dont show that i need to do that


David Maislin

Yeah I just pulled it up :slightly_smiling_face:


David Maislin

Just made an assumption since we require that in so many places lol


David Maislin

ASSume :slightly_smiling_face: