使用SchemaCrawler连接旧版MariaDB遇TLS1.1协议兼容问题求助

初始问题 #

使用SchemaCrawler连接旧版MariaDB实例时，触发以下错误：

The server selected protocol version TLS11 is not accepted by client preferences [TLS13, TLS12]

尝试从runtime\conf\security\java.security的jdk.tls.disabledAlgorithms配置项中移除TLSv1.1，但无效果。有建议通过Java命令行传入‑Djdk.tls.client.protocols="TLSv1.1"参数解决，但不清楚如何给scoop安装的SchemaCrawler添加额外Java参数。

Docker环境下的尝试 #

改用Docker镜像部署SchemaCrawler，自定义schemacrawler.sh脚本添加Java参数。添加-Djdk.tls.client.protocols="TLSv1.1"后，出现新错误：

javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)

由于Docker容器内无法直接编辑java.security文件，创建了enableLegacyTLS.security配置文件（移除原配置中TLS1相关禁用项）：

jdk.tls.disabledAlgorithms=SSLv3, DTLSv1.0, RC4, DES, \
    MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
    include jdk.disabled.namedCurves

并在命令行添加-Djava.security.properties=enableLegacyTLS.security参数，结果仍然报错：

javax.net.ssl.SSLHandshakeException: The server selected protocol version TLS11 is not accepted by client preferences [TLS12]

明明已明确指定使用TLS 1.1，但客户端仍只接受TLS12，完全不符合预期。

完整错误日志 #

SEVERE: Could not connect to <jdbc:mysql://rct-clmadfundchanneldb:3306/>, for <user 'userAppliPHP'>, with properties <{}>
us.fatehi.utility.SQLRuntimeException: Could not connect to <jdbc:mysql://rct-clmadfundchanneldb:3306/>, for <user 'userAppliPHP'>, with properties <{}>
        at us.fatehi.utility.datasource.AbstractDatabaseConnectionSource.getConnection(AbstractDatabaseConnectionSource.java:126)
        at us.fatehi.utility.datasource.SimpleDatabaseConnectionSource.get(SimpleDatabaseConnectionSource.java:113)
        at us.fatehi.utility.datasource.SimpleDatabaseConnectionSource.get(SimpleDatabaseConnectionSource.java:49)
        at schemacrawler.tools.commandline.command.ConnectCommand.loadSchemaRetrievalOptionsBuilder(ConnectCommand.java:180)
        at schemacrawler.tools.commandline.command.ConnectCommand.run(ConnectCommand.java:124)
        at schemacrawler.tools.commandline.SchemaCrawlerCommandLine.executeCommandLine(SchemaCrawlerCommandLine.java:101)
        at schemacrawler.tools.commandline.SchemaCrawlerCommandLine.execute(SchemaCrawlerCommandLine.java:73)
        at schemacrawler.Main.main(Main.java:76)
Caused by: com.mysql.cj.jdbc.exceptions.CommunicationsException: Communications link failure

The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
        at com.mysql.cj.jdbc.exceptions.SQLError.createCommunicationsException(SQLError.java:165)
        at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:55)
        at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:845)
        at com.mysql.cj.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:420)
        at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:238)
        at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:180)
        at us.fatehi.utility.datasource.AbstractDatabaseConnectionSource.getConnection(AbstractDatabaseConnectionSource.java:121)
        ... 7 more
Caused by: com.mysql.cj.exceptions.CJCommunicationsException: Communications link failure

The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
        at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
        at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:52)
        at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:95)
        at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:140)
        at com.mysql.cj.exceptions.ExceptionFactory.createCommunicationsException(ExceptionFactory.java:156)
        at com.mysql.cj.protocol.a.NativeProtocol.negotiateSSLConnection(NativeProtocol.java:367)
        at com.mysql.cj.protocol.a.NativeAuthenticationProvider.connect(NativeAuthenticationProvider.java:198)
        at com.mysql.cj.protocol.a.NativeProtocol.connect(NativeProtocol.java:1336)
        at com.mysql.cj.NativeSession.connect(NativeSession.java:153)
        at com.mysql.cj.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:969)
        at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:833)
        ... 11 more
Caused by: javax.net.ssl.SSLHandshakeException: The server selected protocol version TLS11 is not accepted by client preferences [TLS12]
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:347)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:303)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:294)
        at java.base/sun.security.ssl.ServerHello$ServerHelloConsumer.onServerHello(ServerHello.java:960)
        at java.base/sun.security.ssl.ServerHello$ServerHelloConsumer.consume(ServerHello.java:882)
        at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
        at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:183)
        at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1511)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1421)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:456)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:427)
        at com.mysql.cj.protocol.ExportControlled.performTlsHandshake(ExportControlled.java:206)
        at com.mysql.cj.protocol.StandardSocketFactory.performTlsHandshake(StandardSocketFactory.java:183)
        at com.mysql.cj.protocol.a.NativeSocketConnection.performTlsHandshake(NativeSocketConnection.java:91)
        at com.mysql.cj.protocol.a.NativeProtocol.negotiateSSLConnection(NativeProtocol.java:358)
        ... 16 more

内容的提问来源于stack exchange，提问作者Olivier Gérardin