Connection DNS resolution and SSL validation after DBeaver 23.3 per-connection truststore change

Answer

There is no supported way to flush the JVM DNS cache or refresh hostname verification for an existing DBeaver connection without restarting the application. Hostname verification is controlled only by global JVM/JSSE settings; the per‑connection truststore does not affect it and does not cause an active connection to pick up a rotated certificate until a new connection is established (or DBeaver is restarted).

Likely explanation

DBeaver delegates name resolution and SSL context creation to the underlying Java Runtime. The JVM caches successful DNS lookups according to the networkaddress.cache.ttlSSLContext for that connection, but the hostname verification algorithm (EndpointIdentificationAlgorithm) remains governed by the JVM-wide JSSE security properties. Consequently, changes to the truststore or DNS take effect only for newly created connections or after a JVM restart.

Confirmed facts (from research)

1. DBeaver 23.3 allows a per‑connection truststore via the SSL tab; if the store lacks the server’s root CA, the handshake fails with PKIX path building failed.
2. DNS problems appear as UnknownHostException in the DBeaver log and are often due to stale JVM DNS cache or incorrect proxy settings.
3. There is no UI option to clear the DNS cache or to disable hostname verification on a per‑connection basis.

Steps to mitigate the issue

1. Verify the hostname resolves outside DBeaver: ping or nslookup .
2. Open the connection’s SSL settings, confirm the truststore path, and validate its contents with keytool -list -keystore -storepass .
3. If you need the DNS cache to refresh more quickly, add -Dnetworkaddress.cache.ttl=0 (or a negative value to disable caching) to DBeaver’s vmoptions file. This change requires a restart of DBeaver to take effect.
4. Hostname verification cannot be turned off per connection; to adjust it globally, set JSSE properties such as -Djsse.enableSNIExtension=false or -Djdk.tls.rejectClientInitiatedRenegotiation=true in the same vmoptions file, again requiring a restart.
5. For certificate rotation, close the existing connection (or disconnect the datasource) and open a new one; the new connection will use the updated truststore. If you must keep the same datasource definition open, restart DBeaver after updating the truststore.

Missing diagnostic detail

Have you already configured -Dnetworkaddress.cache.ttl (or a related JVM DNS TTL property) in DBeaver’s vmoptions? If not, adding it and restarting DBeaver is the recommended next step; if you have, further investigation of proxy or hosts‑file settings would be needed.