SSRS 2008 R2 – Using External Images with TLS 1.2

ssrs-2008-r2tls-1.2

One of our SSRS reports loads images from external sources and one of these sources has been locked down to tls 1.2 (which is fair and we're expecting more of our clients to be doing this in the future)

The tls 1.2 update has been applied to the server holding the ReportServer database and the two Reporting Services endpoints held on seperate machines.

All three machines have been tested locally and can all load the secured image in their browsers but when a report is ran using SSRS it fails

I've set up a report for testing which has no database connection, it is simply a non secured image link and a tls 1.2 secured image link,

The error I get is: Warning [rsInvalidImageReference] The ImageData for the image ‘Image2’ is invalid. Details: The request was aborted: Could not create SSL/TLS secure channel.

This leaves the image as src(unknown) in the actual report

So I feel like I've missed something in the installation of the tls 1.2 patch

Anyone have any ideas what might be going on?

Best Answer

I ran into this issue when attempting to run images from IIS Server which was locked down to TLS1.1 and TLS1.2

The issue was two fold

I had to update the Registry to add the following keys

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001

per this article https://support.microsoft.com/en-us/help/3154519/support-for-tls-system-default-versions-included-in-the--net-framework

I also had to use the following Entry in the configuration file for Reporting Services

[Install Location]/Reporting Services/Bin/ReportingServicesService.exe.conf inside the runtime element

Default SQL Server 2016 Location: "C:\Program Files\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe.config"

<AppContextSwitchOverrides value="Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols=false;Switch.System.Net.DontEnableSchUseStrongCrypto=false" />

After all of this all I had to do is restart the reporting service and it was fine

Note that i do have tls 1.1 and 1.2 locked down my SSRS and SQL Server (not sure if this is also a requirement for this fix)

My System Sql Server 2016 and Windows Server 2012 R2

Related Solutions

How to Enable TLS 1.2 for SQL Server 2016 Database Mail

TLS1.2 is the only version of TLS considered secure now (March 2019). It took considerable time and effort to discover that there are 2 essential, additional settings which are required to get this working which are not well known nor well documented, by Microsoft or on the web generally. The following could save you a great deal of time and effort.

These are the 2 new Registry settings that fixed the problem for us:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001

This is a reference to the thread where we eventually found this information, buried halfway down the thread: TLS 1.2 in .NET Framework 4.0

Below is the content for a simple executable registry file that I put together that will make the 2 new settings and the settings already shown on the thread above (i.e. this makes all of the necessary Registry settings*):

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:00000001
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:00000001

Note 1: SQL needs to be restarted for these settings to take affect but it is better to restart Windows since the new settings will affect .NET 4.x generally.

Note 2: In SQL, the SSL-checkbox must be ticked in the mail profile to use TLS1.2.

*Note 3: FYI We ran the free tool, Crypto V2, with the "Best Practices" option enabled before starting on getting this working. We verified our changes afterwards using the new Crypto version 3.

Hopefully this will save considerable time, effort and frustration for others ;)

Sql-server – TLS 1.2 breaks SQL Server linked servers

Are you familiar with using any tools such as netmon, wireshark, or netsh? You might want to do a capture as you replicate this issue. Something that sticks out in my mind is Server B might be trying to hit something external to the mix (i.e. Certificate Revocation List CRL check) and that call is failing. A CRL check takes place on the client side of the equation - in this case Server B is the client. If you are able to run a trace you probably want to filter for tcp resets where the client (Server B) is involved. In wireshark a filter for this would look like tcp.flags.reset == 1 and ip.addr == 10.X.X.X where 10.X.X.X would be the ip address of Server B.