alibaba/canal · critical · RuntimeException

can't encrypt password that will be sent to MySQL server.

Error message

can't encrypt password that will be sent to MySQL server.

What it means

Thrown by ClientAuthenticationPacket.toBytes() when MySQLPasswordEncrypter.scramble411 raises a NoSuchAlgorithmException during the legacy mysql_native_password (4.1) scramble. scramble411 relies on the SHA-1 MessageDigest. The error means the JVM does not provide SHA-1, which is extremely unusual for a stock JDK but can occur on a stripped/custom security provider or a JCE policy that removed SHA-1.

Source

Thrown at driver/src/main/java/com/alibaba/otter/canal/parse/driver/mysql/packets/client/ClientAuthenticationPacket.java:73

        // feature

        // 2. write max_packet_size
        ByteHelper.writeUnsignedIntLittleEndian(MSC.MAX_PACKET_LENGTH, out);
        // 3. write charset_number
        out.write(this.charsetNumber);
        // 4. write (filler) always 0x00...
        out.write(new byte[23]);
        // 5. write (Null-Terminated String) user
        ByteHelper.writeNullTerminatedString(getUsername(), out);
        // 6. write (Length Coded Binary) scramble_buff (1 + x bytes)
        if (StringUtils.isEmpty(getPassword())) {
            out.write(0x00);
        } else {
            try {
                byte[] encryptedPassword = MySQLPasswordEncrypter.scramble411(getPassword().getBytes(), scrumbleBuff);
                ByteHelper.writeBinaryCodedLengthBytes(encryptedPassword, out);
            } catch (NoSuchAlgorithmException e) {
                throw new RuntimeException("can't encrypt password that will be sent to MySQL server.", e);
            }
        }
        // 7 . (Null-Terminated String) databasename (optional)
        if (getDatabaseName() != null) {
            ByteHelper.writeNullTerminatedString(getDatabaseName(), out);
        }
        // 8 . (Null-Terminated String) auth plugin name (optional)
        if (getAuthPluginName() != null) {
            ByteHelper.writeNullTerminated(getAuthPluginName(), out);
        }
        // end write
        return out.toByteArray();
    }

    public String getUsername() {
        return username;
    }

View on GitHub (pinned to 87be50e876)

Solutions

1. Confirm SHA-1 is available: MessageDigest.getInstance("SHA-1") in a shell; if it fails, restore the default SunRsaSign/SunEC/Sun providers in java.security.
2. Remove or relax any java.security property (e.g. jdk.tls.disabledAlgorithms, Alg.Alias) that disables SHA-1.
3. If the environment legitimately forbids SHA-1, switch the MySQL account to caching_sha2_password and use ClientAuthenticationSHA2Packet instead.
4. Use a stock OpenJDK build for the Canal process rather than a stripped runtime.

Example fix

// before
MessageDigest.getInstance("SHA-1"); // fails -> auth packet throws

// after
// verify provider registration
for (java.security.Provider p : java.security.Security.getProviders()) {
    System.out.println(p);
}
// ensure java.security contains: security.provider.1=sun.security.provider.Sun
// and SHA-1 is not in jdk.certpath.disabledAlgorithms for MessageDigest

public static boolean sha1Available() {
    try { java.security.MessageDigest.getInstance("SHA-1"); return true; }
    catch (java.security.NoSuchAlgorithmException e) { return false; }
}
// before authenticating: if (!sha1Available()) fail fast with a clear message

try {
    packet.toBytes();
} catch (RuntimeException e) {
    if (e.getCause() instanceof java.security.NoSuchAlgorithmException) {
        // report unsupported JVM / switch auth plugin
    }
    throw e;
}

When it happens

Trigger: Authenticating to MySQL with a non-empty password using the default ClientAuthenticationPacket (mysql_native_password path) on a JVM whose security configuration disabled the SHA-1 algorithm. Also reproducible if a custom Provider is installed that does not register SHA-1.

Common situations: Hardened/FIPS JVM that removes SHA-1; a minimal JRE in a container image that excluded sun security providers; java.security file edited to strip SHA-1 usage; running on an exotic JDK port.

Related errors

• can't encrypt password that will be sent to MySQL server.
• canal socketChannel netty not support ssl mode: {}
• Invalid destination path
• ERROR # The kafka kerberos configuration file does not exist
• Subscript pulsar consumer error

AI-assisted analysis of alibaba/canal@87be50e876 (2026-08-14). Data as JSON: /api/errors/f2ee3f159a660f44. Report an issue: GitHub.