1

I am trying to connect to my SQL Server 2008 R2 with SP4 database, however, I got this error and I have tried some solutions that I found here, but none works for me.

PS. I do not know exactly how to understand this error, but I sure that is something about SSL+LINUX

Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 35 - An internal exception was caught)

System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception.

Interop+OpenSsl+SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL.

Interop+Crypto+OpenSslCryptographicException: error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol

I know the error is:

SSL Handshake failed with OpenSSL error

My openssl version:

OpenSSL 1.1.1f  31 Mar 2020
built on: Mon Apr 20 11:53:50 2020 UTC
platform: debian-amd64
options:  bn(64,64) rc4(16x,int) des(int) blowfish(ptr) 
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-P_ODHM/openssl-1.1.1f=. -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_TLS_SECURITY_LEVEL=2 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
OPENSSLDIR: "/usr/lib/ssl"
ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1"
Seeding source: os-specific

I have also tried to change my openssl.cnf:

  1. Add this line at the beginning

     openssl_conf = default_conf
    
  2. Add these lines at the end

     [ default_conf ]
     ssl_conf = ssl_sect
     [ssl_sect]
     system_default = ssl_default_sect
    
     [ssl_default_sect]
     MinProtocol = TLSv1.2
     CipherString = DEFAULT:@SECLEVEL=1
    

But I am still getting this error.

PS: I am using Azure Data Studio, VSCode or whenever client like .Net I still getting the error PS: It is important to say that I could connect in the past in the same database, however, I need to format my PC to a new fresh mint installation

6
  • If you're receiving the same error from different clients, then logically the problem should be at the database end. You should verify that the database supports the TLS version requested by the client. By the current standards, that should be TLS v1.1 or v1.2.
    – Haxiel
    Commented Jul 31, 2020 at 15:40
  • Tks, but I think is not a problem DB. I can connect in another PC using Linux mint, and in the past in the same PC, however, I needed to format my PC to a new fresh mint installation and after that ONLY this PC cant connect
    – José Luiz
    Commented Jul 31, 2020 at 15:48
  • Okay, have you cross checked the openssl config file from that system? You may have configured it to use an earlier version of TLS, which the database apparently supports.
    – Haxiel
    Commented Jul 31, 2020 at 15:52
  • This is the problem I do not know how to configure properly, can you help ?
    – José Luiz
    Commented Aug 2, 2020 at 15:34
  • You can start by examining the MinProtocol parameter in the openssl.cnf file. Compare the value of this parameter between the two systems. If the values are the same, do a comparison of the entire file. You can use a diff tool for this, or just do it manually. Once you have identified the difference(s), you can apply the settings from the old system to the new system - be sure to back up the config file first.
    – Haxiel
    Commented Aug 2, 2020 at 17:03

1 Answer 1

0

Tks all, for who is facing the same issue: I Just downgrade the SSL to 1.1.1 and it works.

SQL server 2008 r2 SP3 should support 1.1.1g or 1.1.1f.

Below are the instructions to follow:

  1. Open a terminal (Ctrl+Alt+t).
  2. Fetch the tarball: wget https://www.openssl.org/source/openssl-1.1.1.tar.gz
  3. Unpack the tarball with tar -zxf openssl-1.1.1.tar.gz && cd openssl-1.1.1
  4. Issue the command ./config.
  5. sudo apt install make gcc
  6. make
  7. make test to check for possible errors.
  8. Backup current openssl binary: sudo mv /usr/bin/openssl ~/tmp
  9. Issue the command sudo make install.
  10. sudo ln -s /usr/local/bin/openssl /usr/bin/openssl
  11. Run the command sudo ldconfig to update symlinks and rebuild the library cache.

Assuming that there were no errors in executing steps 4 through 10, you should have successfully installed the new version of OpenSSL.

Again, from the terminal issue the command:

openssl version

Your output should be as follows:

OpenSSL 1.1.1  11 Sep 2018

source(dif openssl but same approach)

https://askubuntu.com/questions/1102803/how-to-upgrade-openssl-1-1-0-to-1-1-1-in-ubuntu-18-04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .