7

I have a customer that is worried about the latest SSL vulnerability POODLE. They have a utility (IIS Crypto 1.4) that disables SSL 2.0-3.0 on the servers they run it on. They have disabled SSL on both the server my service is running and the remote SQL Server. The SQL connection string is pretty standard:

Server=myServerIPAddress;Database=myDataBase;User Id=myUsername;Password=myPassword;

When my service starts it tries to perform a Linq to SQL query and gets the error:

A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 0 - An existing connection was forcibly closed by the remote host.)

If they re-enable SSL on the SQL Server it works fine. My program is a Windows Service built on .NET 3.5. What is the cause of this error, and where can I make adjustments so my service will run?

edit: below is the stacktrace that is spit out by my program when it tries to load

System.Data.SqlClient.SqlException: A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 0 - An existing connection was forcibly closed by the remote host.)
at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) 
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) 
at System.Data.SqlClient.TdsParser.ConsumePreLoginHandshake(Boolean encrypt, Boolean trustServerCert, Boolean& marsCapable) 
at System.Data.SqlClient.TdsParser.Connect(ServerInfo serverInfo, SqlInternalConnectionTds connHandler, Boolean ignoreSniOpenTimeout, Int64 timerExpire, Boolean encrypt, Boolean trustServerCert, Boolean integratedSecurity, SqlConnection owningObject) 
at System.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, Boolean ignoreSniOpenTimeout, Int64 timerExpire, SqlConnection owningObject) 
at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart) 
at System.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance) 
at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance) 
at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection) 
at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options) 
at System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject) 
at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject) 
at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject) 
at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) 
at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) 
at System.Data.SqlClient.SqlConnection.Open() 
at System.Data.Linq.SqlClient.SqlConnectionManager.UseConnection(IConnectionUser user) 
at System.Data.Linq.SqlClient.SqlProvider.get_IsSqlCe() 
at System.Data.Linq.SqlClient.SqlProvider.InitializeProviderMode() 
at System.Data.Linq.SqlClient.SqlProvider.System.Data.Linq.Provider.IProvider.Execute(Expression query) 
at System.Data.Linq.DataQuery`1.System.Collections.Generic.IEnumerable<T>.GetEnumerator() 
at System.Linq.Buffer`1..ctor(IEnumerable`1 source) 
at System.Linq.Enumerable.ToArrayTSource(IEnumerable`1 source) 
8
  • Have you tried to connect from one server to the other? Could it be a firewall issue? What have you tried? Oct 21, 2014 at 16:07
  • Is this error message recorded in the error log on the SQL Server side? If so, is it state 16? Are there any helpful errors immediately before or immediately after? What provider are you using, OLEDB? Did you try others like SQL Native Client? Oct 21, 2014 at 16:09
  • @JustinDoesWork From the error, I gather its connecting, but something on the SQL server side is closing the connection
    – Mike_G
    Oct 21, 2014 at 17:00
  • 1
    Mike, Have you checked if SQL Server Service is running? I disabled SSLv3 and get the same error you get when SQL Server Service is trying to run. For some reason, it seems that SSL is required for this service to logon. At this point I'm stuck and can't make this work. Have you found a solution yet?
    – user50879
    Oct 23, 2014 at 17:12
  • 1
    TLS 1.0, 1.1, and 1.2 are enabled, we get the same error.
    – Mike_G
    Oct 24, 2014 at 17:36

3 Answers 3

4

You are using SQL Authentication. This requires the use of a self signed SSL certificate which is provided by the SQL Server so that the client can encrypt the authentication packets of the connection process.

My guess, no SSL breaks this process.

2

We had a similar issue, except we disabled all but TLS 1.2. Unfortunately some of our clients couldn't connect. These clients were using an older SQL Server Native Client driver that didn't have a compatible encryption protocol. We upgraded the client driver (from MS) and it resolved the issue. In this case the server log should have a better error message (e.g. SQL Server log or Windows System log, again on the server). E.g. "An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The TLS connection request has failed."

support.microsoft.com: TLS 1.2 support for Microsoft SQL Server

SQL Server builds by version code

Something similar happened previously when we upgraded a server but we had some old PCs around that had OS limitations. See other question answer from last year.

Just to clarify, we upgraded the driver sub-version (e.g. 11.0.2100.60 to 11.0.7001). Obviously your SQL Server instance needs to be of sufficient service pack/version to handle the required encryption protocols. Note that the stand-alone client driver is (only?) available as part of the relevant Microsoft SQL Server "feature pack" (e.g. Microsoft SQL Server 2012 SP4 Feature Pack).

1

Just a wild guess, but my first look would be at Sql Server Configuration Manager to see if the "Force Encryption" flag is on for that instance. Just because they've "disabled SSL" it doesn't mean they've told SQL Server that non-SSL connections are ok.

Otherwise see the comments above about the SQL Server error log.

1
  • I thought the same, but since the customer claimed other apps were able to make the connection without issue I didn't check that yet.
    – Mike_G
    Oct 21, 2014 at 17:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.