3

NOTE: Requested to move the question from StackOverflow to dba

Don't know if this is really a SQL Server problem or not.

Client moved to TLS 1.2, it broke an app that connects to SQL Server 2017 and it got dumped on my lap.

Being a Linux person all I can say is when they went back to TLS 1.1 it worked and here is the only error message I can glean in all this mess:

dbnetlib connectionopen secdoclienthandshake ssl security error

In SS Studio, when I click on the DB I get this error message:

Error connecting to 'hostname'.

Login failed for user 'CORP\myaccount'. (.Net SqlClient Data Provider)

Server Name: hostname
Error Number: 18456
Severity: 14
State: 1
Line Number: 65536

Program Location:

at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, SqlCredential credential, Object providerInfo, String newPassword, SecureString newSecurePassword, Boolean redirectedUserInstance, SqlConnectionString userConnectionOptions, SessionData reconnectSessionData, DbConnectionPool pool, String accessToken, Boolean applyTransientFaultHandling, SqlAuthenticationProviderManager sqlAuthProviderManager)
at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, DbConnectionPoolKey poolKey, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection, DbConnectionOptions userOptions)
at System.Data.ProviderBase.DbConnectionFactory.CreateNonPooledConnection(DbConnection owningConnection, DbConnectionPoolGroup poolGroup, DbConnectionOptions userOptions)
at System.Data.ProviderBase.DbConnectionFactory.TryGetConnection(DbConnection owningConnection, TaskCompletionSource1 retry, DbConnectionOptions userOptions, DbConnectionInternal oldConnection, DbConnectionInternal& connection)
at System.Data.ProviderBase.DbConnectionInternal.TryOpenConnectionInternal(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource
1 retry, DbConnectionOptions userOptions)
at System.Data.ProviderBase.DbConnectionClosed.TryOpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions)
at System.Data.SqlClient.SqlConnection.TryOpenInner(TaskCompletionSource
1 retry)
at System.Data.SqlClient.SqlConnection.TryOpen(TaskCompletionSource`1 retry)
at System.Data.SqlClient.SqlConnection.Open()
at Microsoft.SqlServer.Management.SqlStudio.Explorer.ObjectExplorerService.ValidateConnection(UIConnectionInfo ci, IServerType server)
at Microsoft.SqlServer.Management.SqlStudio.Explorer.ObjectExplorerService.ConnectToServer(UIConnectionInfo connectionInfo, IDbConnection liveConnection, Boolean validateConnection)

TLS 1.2 was turned/put on the server that hosts SS.

3

Older versions of SQL Server and SQL Server clients simply don't support TLS 1.2. Please check out TLS 1.2 support for Microsoft SQL Server to see what you might need, or just upgrade SQL Server to the latest service pack/update, and the client to the latest version. Since I see you're using SQL Server 2017, you should be fine on the server side and you should just need to address this on the client side. Based on your stack trace, I'm thinking that a .NET upgrade will address this for you.

We have numerous connections using various versions and platforms of SQL clients (including jTDS) connected using TLS 1.2 with various versions of SQL Server. The latest official release of jTDS doesn't support TLS 1.2, so you have to download an unreleased dev version, or convert it to JDBC, which is really the best option as jTDS is a dead project.

2
  • Thanks Tony. Based on the link you provided it says, " SQL Server 2017 on Windows ships with TLS 1.0 to TLS 1.2 support. You have to >>> disable TLS 1.0 and 1.1 <<< if you want to use only TLS 1.2 for client-server communication." What do I do (or check) from the server side? thanks again
    – Marinaio
    Feb 12 '20 at 16:43
  • 1
    See the frequently asked questions section in the link--it shows registry values for how to enable TLS 1.2. The same values are there for 1.0 and 1.1, so you just set Disabled to 1 and EnabledByDefault to 0 for them. Feb 12 '20 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.