Please check this one:
Windows updates causing IMC running exceptions
Symptom
The IMC database might fail to be connected after any of the following Windows updates are installed:
• KB3172605
• KB3172614
• KB3161608
• KB3161606
• KB3156418
The iMC\client\log\imcforeground.log and iMC\deploy\log\dma.log logs show the following error messages:
• 2016-09-30 23:40:03 [ERROR] [Database Checking Thread] [com.h3c.imc.deploy.dma.EnvPanel::a(1160)] Access database error
• com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "SQL Server did not return a response. The connection has been closed. ClientConnectionId:322f5985-33eb-4bb4-b476-6ecb256a2cd8.
Analysis
Microsoft confirmed that the previously mentioned updates added the TLS_DHE_RSA_WITH_AES_256_CBC_SHA and TLS_DHE_RSA_WITH_AES_128_CBC_SHA cipher suites but the cipher suites have problems that can cause database connection failure.
The two new cipher suites were added for compatibility with early applications that use RC4 (https://en.wikipedia.org/wiki/RC4), which is not used by industry at present. The two cipher suites use 512-bit encryption. Microsoft considers that 512-bit encryption is not secure enough, and another Windows update (https://support.microsoft.com/en-us/kb/3061518) forces the server to use 1024-bit encryption, resulting in decryption failure on IMC.
Solution
On the IMC database server, check whether the Windows updates that contain the two problem cipher suites are installed and the two cipher suites are enabled:
a. Copy the MSKBsC.zip file from the tools/MSKBsC directory of IMC to any path of the database server.
b. Decompress and run the file to test the environment.
c. Check the test result:
− If the Check pass message is displayed, the environment does not have the problem, and you can use IMC normally.
− If the Check does not pass, you need to repair it message is displayed, the problem exists and you must repair the problem. For more information, see "Repairing the problem on the database server."
− If the Check does not pass, the server has joined a domain message is displayed, the problem exists and you must repair the problem on the database server and make sure the two problem cipher suites are disabled on the domain server. For more information, see "Repairing the problem on the database server" and "Repairing the problem on the domain server."
Repairing the problem on the database server
1. Enter gpedit.msc in the CLI or search field to open the Local Group Policy Editor.
2. In the left pane of the editor, click Local Computer Policy, and then select Computer Configuration > Administrative Templates > Network > SSL Configuration Settings.
3. In the right pane of the editor, double-click SSL Cipher Suite Order.
4. Select Enabled.
5. Under Options > SSL Cipher Suites, copy the contents into a text file (example: Notepad) as a backup copy.
6. In the SSL Cipher Suite field, locate and delete the following two ciphers by strictly following the operation guide in the Help area of the preceding figure: a. TLS_DHE_RSA_WITH_AES_256_CBC_SHA
b. TLS_DHE_RSA_WITH_AES_128_CBC_SHA
** Caution: Many of the ciphers are similar in context, so be sure the cipher matches exactly before deleting. **
7. Click Apply, and then click OK.
8. Reboot the computer.
Repairing the problem on the domain server
If you need to repair the problem on the domain server, contact the administrator of the domain server to perform the repair, using the following method.
1. Open the Control Panel > Administrative Tools > Group Policy Management. Expand the domain where the IMC database server resides. In Group Policy Objects, find the group policy object to which the IMC database server belongs. Right-click Edit to open the Group Policy Management Editor.
2. In the left pane of the editor, select Computer Configuration > Policy > Administrative Templates > Network > SSL Configuration Settings.
3. In the right pane of the editor, double-click SSL Cipher Suite Order.
4. Select Enabled.
5. Under Options > SSL Cipher Suites, copy the contents into a text file (example: Notepad) as a backup copy.
6. In the SSL Cipher Suite field, locate and delete the following two ciphers by strictly following the operation guide in the Help area of the preceding figure: a. TLS_DHE_RSA_WITH_AES_256_CBC_SHA
b. TLS_DHE_RSA_WITH_AES_128_CBC_SHA
** Caution: Many of the ciphers are similar in context, so be sure the cipher matches exactly before deleting. **
7. Click Apply, and then click OK.
Some picture in this document I could not copy. So if you want have the complete document, please email me.
Best Regards!
