0

We have a Windows 2008 R2 server running SQL 2012 Express RTM (11.0.2100.60).

All three protocols (shared memory, named pipes, TCP/IP) are enabled for the server and both 32-bit and 64-bit clients. No certificate is configured, and encryption is not required. SQL Server is configured for mixed-mode authentication.

A few weeks back, we added the registry key to disable SSLv3 for server software, but didn't restart the server. All three TLS protocols (1.0, 1.1 and 1.2) are enabled.

This morning, after installing the critical MS14-066 patch and restarting, SQL Server would not accept any connections. Using shared memory or named pipes returned the dreaded "no process is on the other end of the pipe" error. Using TCP/IP returned a "connection forcibly closed" error.

Uninstalling the patch made no difference - we were still unable to connect to SQL. Only after re-enabling SSLv3 and restarting the server were we able to reconnect. We have since reinstalled the patch, and the problem has not returned.

Therefore, I can only conclude that SQL Server requires SSLv3 to be enabled, even if the connections are not encrypted. However, I can't find this documented anywhere.

Can anyone else confirm this? Is it a known issue?

Improve this question
3
  • Do you have TLS 1.0, TLS 1.1, and TLS 1.2 (all three of them) enabled? This is from the link in your post, Microsoft Security Advisory 3009008, on disabling SSLv3. The link does not specifically call out SQL Server, but as posted, it is an operating system issue.
    – RLF
    Nov 12, 2014 at 16:37
  • @RLF: Yes, TLS 1.0, 1.1 and 1.2 are all enabled. Setting HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server\Enabled to 0 and restarting prevents access to SQL. Setting back to 1 and restarting restores access.
    – Richard Deeming
    Nov 12, 2014 at 20:50
  • I can confirm this. I am trying to log into SalesForce and copy data to SQL Server. SalesForce requires TLS 1.1 or TLS 1.2, if TLS 1.0 is used it won't connect. And it seems to be falling back to SSL 3.0 when it can't find TLS 1.0. So I tried to disable SSL 3.0. Immediately the procedure reports it can't connect to SQL Server.I thought maybe it was a server issue, so I told it to go to my local copy of SQL Server on my laptop. Still the same. I can connect to SQL Server if I enable SSL 3.0, can't if it is disabled. And I can't connect to SalesForce with SSL 3.0 enabled.
    – Jim Denney
    Dec 6, 2017 at 21:16

2 Answers 2

Reset to default
1

You need a recent CU for TLS1.2. See https://support.microsoft.com/en-us/kb/3052404:

  • Cumulative Update 8 for SQL Server 2014
  • Cumulative Update 1 for SQL Server 2014 SP1
  • Cumulative Update 6 for SQL Server 2012 SP2
  • Cumulative Update 7 for SQL Server 2014

After enabling only TLS 1.2 you will possibly encounter two errors:

  1. SQL Server 2014 Agent will not start. Solution: install SQL Server 2012 SNAC from one of the 2012 CUs...
  2. SQL Server Management Studio can't connect. Solution: install .net Framework v4.6.

Furthermore you have to update the SNAC/OBDC driver on all clients connecting to the SQL Server.

Improve this answer
1

I can't confirm whether SQL Server needs SSLv3 for secure connections ... but I can tell you for sure that the MS14-066 patch introduced all sorts of problems in https traffic with reports all over the web for browsers that stopped working, SQL Server connections that all of a sudden started using high CPU and so on ... all in all a pretty buggy patch and we're all waiting on Microsoft to come clean and tell us how to safely undo it while still protecting our systems from the mystery bug that the patch supposedly fixed.

For more details see this:

http://odetodata.com/2014/11/microsoft-patch-ms14-066-leads-to-https-problems-with-iis-and-google-chrome/

Improve this answer
1
  • Thanks for that. Fortunately, we haven't seen any of the problems mentioned with that patch - IIS / SSL is still working in IE, Firefox and Chrome. Only toggling the enabled flag for SSLv3 and restarting made any difference.
    – Richard Deeming
    Nov 18, 2014 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.