SSRS using external images through tls 1.2 leaves src(unknown)

Question

One of our SSRS reports loads images from external sources and one of these sources has been locked down to tls 1.2 (which is fair and we're expecting more of our clients to be doing this in the future)

The tls 1.2 update has been applied to the server holding the ReportServer database and the two Reporting Services endpoints held on seperate machines.

All three machines have been tested locally and can all load the secured image in their browsers but when a report is ran using SSRS it fails

I've set up a report for testing which has no database connection, it is simply a non secured image link and a tls 1.2 secured image link,

The error I get is: Warning [rsInvalidImageReference] The ImageData for the image ‘Image2’ is invalid. Details: The request was aborted: Could not create SSL/TLS secure channel.

This leaves the image as src(unknown) in the actual report

So I feel like I've missed something in the installation of the tls 1.2 patch

Anyone have any ideas what might be going on?

Answer 1

I ran into this issue when attempting to run images from IIS Server which was locked down to TLS1.1 and TLS1.2

The issue was two fold

I had to update the Registry to add the following keys

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001 

per this article https://support.microsoft.com/en-us/help/3154519/support-for-tls-system-default-versions-included-in-the--net-framework

I also had to use the following Entry in the configuration file for Reporting Services

[Install Location]/Reporting Services/Bin/ReportingServicesService.exe.conf inside the runtime element

Default SQL Server 2016 Location: "C:\Program Files\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe.config"

<AppContextSwitchOverrides value="Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols=false;Switch.System.Net.DontEnableSchUseStrongCrypto=false" />

After all of this all I had to do is restart the reporting service and it was fine

Note that i do have tls 1.1 and 1.2 locked down my SSRS and SQL Server (not sure if this is also a requirement for this fix)

My System Sql Server 2016 and Windows Server 2012 R2

Answer 2

This was immensely useful, and did in fact resolve the similar issue we were having when displaying images in our SSRS reports that were hosted on AWS S3/CloudFront.

Details:

• Our AWS S3 bucket uses CloudFront CDN to distribute data.
• CloudFront is configured to use a custom hostname and our own x.509 certificate for security.
• That CloudFront distribution has the TLSv1.2_2021 security policy applied.
• Because SSRS insists on having .NET download and embed the images in the report as base64-encoded data (instead of just rendering HTML tags that let the client browser download the images), SSRS/.NET couldn't access the images stored behind TLS1.2 encryption. This resulted in no visible errors, but missing images. It took quite a while to track down.

One workaround for AWS, without making the registry/config changes above, is to use the S3 bucket address instead of the CDN in your SSRS reports. s3.amazonaws.com seems to support TLS 1.0 and 1.1, which SSRS/.NET 2 can use.

Also: Many posts online talk about using the execution account to enable external images in SSRS. That's if the images are stored on some domain-secured server (Sharepoint, etc) that needs credentials, not some public web server or CDN. I did NOT need that to load AWS S3 images in SSRS reports after the fix above.

Microsoft -- perhaps it's time to drink your own Kool-Aid and upgrade SSRS to a modern version of .NET!