SQL Server – Does It Require SSLv3?

sql serversql-server-2012ssl

We have a Windows 2008 R2 server running SQL 2012 Express RTM (11.0.2100.60).

All three protocols (shared memory, named pipes, TCP/IP) are enabled for the server and both 32-bit and 64-bit clients. No certificate is configured, and encryption is not required. SQL Server is configured for mixed-mode authentication.

A few weeks back, we added the registry key to disable SSLv3 for server software, but didn't restart the server. All three TLS protocols (1.0, 1.1 and 1.2) are enabled.

This morning, after installing the critical MS14-066 patch and restarting, SQL Server would not accept any connections. Using shared memory or named pipes returned the dreaded "no process is on the other end of the pipe" error. Using TCP/IP returned a "connection forcibly closed" error.

Uninstalling the patch made no difference – we were still unable to connect to SQL. Only after re-enabling SSLv3 and restarting the server were we able to reconnect. We have since reinstalled the patch, and the problem has not returned.

Therefore, I can only conclude that SQL Server requires SSLv3 to be enabled, even if the connections are not encrypted. However, I can't find this documented anywhere.

Can anyone else confirm this? Is it a known issue?

Best Answer

You need a recent CU for TLS1.2. See https://support.microsoft.com/en-us/kb/3052404:

  • Cumulative Update 8 for SQL Server 2014
  • Cumulative Update 1 for SQL Server 2014 SP1
  • Cumulative Update 6 for SQL Server 2012 SP2
  • Cumulative Update 7 for SQL Server 2014

After enabling only TLS 1.2 you will possibly encounter two errors:

  1. SQL Server 2014 Agent will not start. Solution: install SQL Server 2012 SNAC from one of the 2012 CUs...
  2. SQL Server Management Studio can't connect. Solution: install .net Framework v4.6.

Furthermore you have to update the SNAC/OBDC driver on all clients connecting to the SQL Server.

Related Question