1. Connect with mssql-jdbc

Opens a session against an OriginChainDB TDS listener with Microsoft's JDBC driver, and reads five rows back. Measured against mssql-jdbc 13.4.0 and 12.10.1, both 34 of 34 checks, on 2026-09-07.

export OC_SQL_HOST=...        # the endpoint your console shows
export OC_DATABASE=...
export OC_DB_USER=...
export OC_DB_PASSWORD=...     # never inline this in the URL

import java.sql.*;

public class Connect {
    public static void main(String[] args) throws Exception {
        String url = "jdbc:sqlserver://" + System.getenv("OC_SQL_HOST") + ":1433"
                   + ";databaseName="         + System.getenv("OC_DATABASE")
                   // TLS is mandatory. Without it there is no listener to reach.
                   + ";encrypt=true"
                   // Validate the chain. Only relax this against a test instance.
                   + ";trustServerCertificate=false"
                   + ";hostNameInCertificate=" + System.getenv("OC_SQL_HOST")
                   + ";loginTimeout=30";

        try (Connection conn = DriverManager.getConnection(
                url, System.getenv("OC_DB_USER"), System.getenv("OC_DB_PASSWORD"));
             Statement st = conn.createStatement();
             ResultSet rs = st.executeQuery(
                 "SELECT TOP 5 id, customer_ref, amount_cents"
               + "  FROM invoices ORDER BY amount_cents DESC")) {

            while (rs.next()) {
                System.out.printf("%d  %-12s %d%n",
                    rs.getInt("id"), rs.getString("customer_ref"), rs.getInt("amount_cents"));
            }
        }
    }
}

4101  ACME-77       129900
4088  ACME-12        98450
4077  ORBIT-3        61000
4051  ACME-77        44900
4020  ORBIT-9        12750

• encrypt=true is not a hardening option here, it is the only way in. A listener with no loadable certificate never binds, so a certificate problem shows up as a connection that finds nothing at all:

com.microsoft.sqlserver.jdbc.SQLServerException:
  The TCP/IP connection to the host ..., port 1433 has failed.

• If that is what you see, check the certificate before the firewall. Then check whether a listener was ever enabled — it is off by default on every instance.
• TOP 5 is translated to a LIMIT. The translated set lists what else is rewritten, and the refused set lists what is not.
• Keep the password out of the URL. The driver takes it as a separate argument, and a URL is the thing that ends up in a log.