4

We have been hardening our servers for some time now and recently we disabled SSL 3.0 because of the poodle attack. When I did this on one of our test servers SQL Server failed to start up after the restart.

I have been able to reproduce this on Windows Server 2012 and Windows 7 by disabling TLS 1.0 and SSL 3.0 through the registry. I am using SQL Server 2012 on the server machine. On my windows 7 machine sql server 2012 and sql server 2005 will not start with those disabled.

These are the event log errors I get:

Application Logs:

(28/10/2014 8:38:54 AM) SQL Server could not spawn FRunCM thread. Check the SQL Server error log and the Windows event logs for information about possible related problems. (28/10/2014 8:38:54 AM) Could not start the network library because of an internal error in the network library. To determine the cause, review the errors immediately preceding this one in the error log. (28/10/2014 8:38:54 AM) TDSSNIClient initialization failed with error 0x80090331, status code 0x1. (28/10/2014 8:38:54 AM) TDSSNIClient initialization failed with error 0x80090331, status code 0x80.

System Logs

(28/10/2014 8:38:54 AM) The SQL Server (MSSQLSERVER) service terminated with service-specific error %%-2146893007. (28/10/2014 8:38:54 AM) A fatal error occurred while creating an SSL server credential. The internal error state is 10013.

Done anyone know have we can keep SSL 3.0 and TLS 1.0 disabled and get SQLServer server to start?

migrated from stackoverflow.com Nov 8 '14 at 5:25

This question came from our site for professional and enthusiast programmers.

  • As of January 29th, Microsoft SQL Server supports TLS 1.2 for SQL Server 2008, SQL Server 2008 R2, SQL Server 2012 and SQL Server 2014 and major client drivers like Server Native Client, Microsoft ODBC Driver for SQL Server, Microsoft JDBC Driver for SQL Server and ADO.NET (SqlClient). Blog post about the release: blogs.msdn.com/b/sqlreleaseservices/archive/2016/01/29/… List of builds that support TLS 1.2 along with the client and server component download locations (KB3135244): support.microsoft.com/kb/3135244 – Amit Banerjee Jan 30 '16 at 1:19
4

The issue still remains if TLS 1.0 and SSL 3.0 are disabled. At the moment I don't see any way around this and maybe Microsoft needs to look into this for the future as TLS 1.0 is likely to be phased out over time.

The reason I had TLS 1.0 disabled was to mitigate the BEAST attack, as I found in some reading last night this was the wrong way to do this. To properly disable the BEAST attack on a server one should elevate a specific RC4 cipher so it is the one used with TLS 1.0. Unfortunately this raised another about the fact that the RC4 cipher is also vulnerable but that is another discussion.

I realize that I have not found an answer to the question. But my issue has been solve by keeping TLS 1.0 enabled in the registry.

1

You need a recent CU for TLS1.2. See https://support.microsoft.com/en-us/kb/3052404:

  • Cumulative Update 8 for SQL Server 2014
  • Cumulative Update 1 for SQL Server 2014 SP1
  • Cumulative Update 6 for SQL Server 2012 SP2
  • Cumulative Update 7 for SQL Server 2014

After enabling only TLS 1.2 you will possibly encounter two errors:

  1. SQL Server 2014 Agent will not start. Solution: install SQL Server 2012 SNAC from one of the 2012 CUs...
  2. SQL Server Management Studio can't connect. Solution: install .net Framework v4.6.

Furthermore you have to update the SNAC/OBDC driver on all clients connecting to the SQL Server.

  • Thanks for taking the time to post these, Jens. Your answers did generate an automatic system flag, which I reviewed very carefully and dismissed on the basis the questions are not duplicates (and therefore not candidates for merging). I hope you can understand the immediate reaction when people see the "same" answer posted multiple times. If the answers can be customized a little for each question, so much the better, but that is not required. Thanks again for your contributions here. – Paul White Aug 16 '15 at 2:49
0

Just a guess, but make sure that at least one of TLS 1.1 or TLS 1.2 is explicitly enabled. It may be that you've mandated a secured connection, but then removed any protocols currently supported by the server that it could use to accomplish this.

  • I tried this on both my Server 2012 machine and Windows 7 machine without success. – Nic Mullens Oct 28 '14 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy