4

We recently upgraded a non-production SQL Server 2008 R2 system to SP3, and then Windows Updates installed the latest Security Update (10.50.6560.0). I see that TLS 1.2 support for 2008 R2 is provided in 10.50.6542.0, but that update will not install on top of 6560. Login attempts are failing and I can see in Event Viewer that the client is requesting TLS 1.2, but the server doesn't support it.

SSMS returns:

...(provider: SSL Provider, error: 0 - An existing connection was forcibly closed by the remote host.)
(Microsoft SQL Server, Error: 10054)

System Event Log on server:

Event ID 36874
An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.

I have tried updating the various SQL clients on both client and server, enabling TLS 1.2 in the registry on the server (and rebooting), to no avail. So now I'm beginning to think that build 6560 doesn't support it, and if that's the case, I have to uninstall it somehow so that I can install build 6542 first.

We have other servers running the same build that work fine, so I'm trying to find what's different about this server--no luck yet.

  • 2
    6560 includes the fixes from 6542, so uninstalling the former to install the latter is not going to get you anywhere. This is not SQL Server but another component, likely SqlClient or .NET Framework. Did you install all applicable updates from the second and third tables here? I don't think you'll get any of those by default from Windows Update. – Aaron Bertrand Jul 25 '18 at 17:26
  • This answer shows the required minimums for TLS 1.2 on SQL Server 2008 R2. – Max Vernon Jul 25 '18 at 18:39
  • Regarding article reference by @AaronBertrand, none of the .NET updates that are listed apply on the server (I have tried them all). I have updated the client with every type of driver (ADO.Net, 2012 and 2008 R2 native clients, and ODBC). I have also created the reg keys to enable TLS 1.2 on the server (and rebooted). – Tony Hinkle Jul 25 '18 at 19:24
  • 1
    At this point I would engage Microsoft customer support. – Aaron Bertrand Jul 25 '18 at 19:33
1

Build 10.50.6560.0 does support TLS 1.2. I was able to resolve the problem by installing a new certificate from our CA. Apparently the older certificates that are on the server are not capable of supporting TLS 1.2.

TLS 1.2 support for Microsoft SQL Server includes information regarding the client and server versions that are required to support TLS 1.2.

0

We have just moved to Exchange 2016 and our 2008 R2 servers were unable to send emails after that. I configured Database Mail for SSL and port 587 and gave it a trusted login but then found an error in the Eventlog that was to do with the system not being able to download a certificate. I therefore downloaded it manually and installed it and was able to send emails after that.

The certificate is:

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/47BEABC922EAE80E78783462A79F45C254FDE68B.crt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.