SQL Server Environment: OS version: Windows 2012 R2 Microsoft SQL Server 2014 (SP3-CU4-GDR) (KB4583462) - 12.0.6433.1 (X64) Instance type: Named instance

When I am attempting to connect from a Docker container (running Debian 10 and ODBC 17 for SQL Server) to SQL Server, we get the error [Client unable to establish connection]. If we downgrade the Cipherstring in the /etc/ssl/openssl.cnf file in our Docker container from DEFAULT@SECLEVEL=2 to DEFAULT@SECLEVEL=1 the connection works.

Why does it work with the same version when the setting is DEFAULT@SECLEVEL=2?

I have another SQL Serer with same version which works.

I exported the Cipher suites and TLS settings using the below commands from working and compared them with the ones from NotWorking and they were identical.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /s  > c:/tmp/%computername%_ClientSchannelConfigs.txt

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002" /s  >  c:/tmp/%computername%_ClientCipherSuitesConfigs.txt

I was able to extract the certificate using nmap. Not working server is generating an rsa key length of 1024 (insecure) and working server is using a certificate that is of appropriate length: 2048. How can we make Non Working server RSA key length to 2048?

❯ docker run -it instrumentisto/nmap -sV --script ssl-cert -p 1433 XXXXXXXXXXXXXXXX Starting Nmap 7.92 ( https://nmap.org ) at 2021-10-14 20:08 UTC Nmap scan report for XXXXXXXXXXXXXXXXXXXX Host is up (0.0021s latency). Other addresses for XXXXXXXXXXXXXXXXXXXXXXXXX

1433/tcp open ms-sql-s Microsoft SQL Server 2014 12.00.6433 | ssl-cert: Subject: commonName=XXXXXXXXXXXXXXXXXXXXX | Subject Alternative Name: DNS:XXXXXXXXXXXXXXXXXXXX | Issuer: commonName=XXX Intermediate CA -1 | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2021-08-19T09:01:24 | Not valid after: 2023-08-19T09:01:24 | MD5: 7116 61d2 eca6 01b1 19f5 f4e9 0e46 42d5 |_SHA-1: f81b 8ed7 455c e981 a712 83ab 5fd5 3802 4d67 da4f Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Not working Server:

Public Key type: rsa

Public Key bits: 1024

1 Answer 1


How can we make Non Working server RSA key length to 2048?

Use a company certificate that has the key length you'd like.

If you're relying on the self generated certificates created by SQL Server as a nicety, then you'll instead want to use your own as there is no way to change that, it's hard coded.

For completeness, other items associated with this issue.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.