Sql-server – Why does TLS1.2 break connections to SQL Server

sql servertls-1.2

NOTE: Requested to move the question from StackOverflow to dba

Don't know if this is really a SQL Server problem or not.

Client moved to TLS 1.2, it broke an app that connects to SQL Server 2017 and it got dumped on my lap.

Being a Linux person all I can say is when they went back to TLS 1.1 it worked and here is the only error message I can glean in all this mess:

dbnetlib connectionopen secdoclienthandshake ssl security error

In SS Studio, when I click on the DB I get this error message:

Error connecting to 'hostname'.

Login failed for user 'CORP\myaccount'. (.Net SqlClient Data Provider)

Server Name: hostname
Error Number: 18456
Severity: 14
State: 1
Line Number: 65536

Program Location:

at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, SqlCredential credential, Object providerInfo, String newPassword, SecureString newSecurePassword, Boolean redirectedUserInstance, SqlConnectionString userConnectionOptions, SessionData reconnectSessionData, DbConnectionPool pool, String accessToken, Boolean applyTransientFaultHandling, SqlAuthenticationProviderManager sqlAuthProviderManager)
at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, DbConnectionPoolKey poolKey, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection, DbConnectionOptions userOptions)
at System.Data.ProviderBase.DbConnectionFactory.CreateNonPooledConnection(DbConnection owningConnection, DbConnectionPoolGroup poolGroup, DbConnectionOptions userOptions)
at System.Data.ProviderBase.DbConnectionFactory.TryGetConnection(DbConnection owningConnection, TaskCompletionSource1 retry, DbConnectionOptions userOptions, DbConnectionInternal oldConnection, DbConnectionInternal& connection)
at System.Data.ProviderBase.DbConnectionInternal.TryOpenConnectionInternal(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions)
at System.Data.ProviderBase.DbConnectionClosed.TryOpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions)
at System.Data.SqlClient.SqlConnection.TryOpenInner(TaskCompletionSource1 retry)
at System.Data.SqlClient.SqlConnection.TryOpen(TaskCompletionSource`1 retry)
at System.Data.SqlClient.SqlConnection.Open()
at Microsoft.SqlServer.Management.SqlStudio.Explorer.ObjectExplorerService.ValidateConnection(UIConnectionInfo ci, IServerType server)
at Microsoft.SqlServer.Management.SqlStudio.Explorer.ObjectExplorerService.ConnectToServer(UIConnectionInfo connectionInfo, IDbConnection liveConnection, Boolean validateConnection)

TLS 1.2 was turned/put on the server that hosts SS.

Best Answer

Older versions of SQL Server and SQL Server clients simply don't support TLS 1.2. Please check out TLS 1.2 support for Microsoft SQL Server to see what you might need, or just upgrade SQL Server to the latest service pack/update, and the client to the latest version. Since I see you're using SQL Server 2017, you should be fine on the server side and you should just need to address this on the client side. Based on your stack trace, I'm thinking that a .NET upgrade will address this for you.

We have numerous connections using various versions and platforms of SQL clients (including jTDS) connected using TLS 1.2 with various versions of SQL Server. The latest official release of jTDS doesn't support TLS 1.2, so you have to download an unreleased dev version, or convert it to JDBC, which is really the best option as jTDS is a dead project.

Related Question