Disabled SSL on SQL Server, now connection fails

Question

I have a customer that is worried about the latest SSL vulnerability POODLE. They have a utility (IIS Crypto 1.4) that disables SSL 2.0-3.0 on the servers they run it on. They have disabled SSL on both the server my service is running and the remote SQL Server. The SQL connection string is pretty standard:

Server=myServerIPAddress;Database=myDataBase;User Id=myUsername;Password=myPassword;

When my service starts it tries to perform a Linq to SQL query and gets the error:

A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 0 - An existing connection was forcibly closed by the remote host.)

If they re-enable SSL on the SQL Server it works fine. My program is a Windows Service built on .NET 3.5. What is the cause of this error, and where can I make adjustments so my service will run?

edit: below is the stacktrace that is spit out by my program when it tries to load

System.Data.SqlClient.SqlException: A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 0 - An existing connection was forcibly closed by the remote host.)
at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) 
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) 
at System.Data.SqlClient.TdsParser.ConsumePreLoginHandshake(Boolean encrypt, Boolean trustServerCert, Boolean& marsCapable) 
at System.Data.SqlClient.TdsParser.Connect(ServerInfo serverInfo, SqlInternalConnectionTds connHandler, Boolean ignoreSniOpenTimeout, Int64 timerExpire, Boolean encrypt, Boolean trustServerCert, Boolean integratedSecurity, SqlConnection owningObject) 
at System.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, Boolean ignoreSniOpenTimeout, Int64 timerExpire, SqlConnection owningObject) 
at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart) 
at System.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance) 
at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance) 
at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection) 
at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options) 
at System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject) 
at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject) 
at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject) 
at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) 
at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) 
at System.Data.SqlClient.SqlConnection.Open() 
at System.Data.Linq.SqlClient.SqlConnectionManager.UseConnection(IConnectionUser user) 
at System.Data.Linq.SqlClient.SqlProvider.get_IsSqlCe() 
at System.Data.Linq.SqlClient.SqlProvider.InitializeProviderMode() 
at System.Data.Linq.SqlClient.SqlProvider.System.Data.Linq.Provider.IProvider.Execute(Expression query) 
at System.Data.Linq.DataQuery`1.System.Collections.Generic.IEnumerable<T>.GetEnumerator() 
at System.Linq.Buffer`1..ctor(IEnumerable`1 source) 
at System.Linq.Enumerable.ToArrayTSource(IEnumerable`1 source) 

Answer 1

You are using SQL Authentication. This requires the use of a self signed SSL certificate which is provided by the SQL Server so that the client can encrypt the authentication packets of the connection process.

My guess, no SSL breaks this process.

Answer 2

We had a similar issue, except we disabled all but TLS 1.2. Unfortunately some of our clients couldn't connect. These clients were using an older SQL Server Native Client driver that didn't have a compatible encryption protocol. We upgraded the client driver (from MS) and it resolved the issue. In this case the server log should have a better error message (e.g. SQL Server log or Windows System log, again on the server). E.g. "An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The TLS connection request has failed."

support.microsoft.com: TLS 1.2 support for Microsoft SQL Server

SQL Server builds by version code

Something similar happened previously when we upgraded a server but we had some old PCs around that had OS limitations. See other question answer from last year.

Just to clarify, we upgraded the driver sub-version (e.g. 11.0.2100.60 to 11.0.7001). Obviously your SQL Server instance needs to be of sufficient service pack/version to handle the required encryption protocols. Note that the stand-alone client driver is (only?) available as part of the relevant Microsoft SQL Server "feature pack" (e.g. Microsoft SQL Server 2012 SP4 Feature Pack).

Answer 3

Just a wild guess, but my first look would be at Sql Server Configuration Manager to see if the "Force Encryption" flag is on for that instance. Just because they've "disabled SSL" it doesn't mean they've told SQL Server that non-SSL connections are ok.

Otherwise see the comments above about the SQL Server error log.