TLS 1.2 support for Microsoft SQL Server

Applies to:   SQL Server
Original KB number:   3135244

Summary

This article describes TLS 1.2 support for Microsoft SQL Server. It lists the SQL Server builds that enable TLS 1.2 server-side, the client drivers and providers that support TLS 1.2, the .NET Framework updates that SQL Server features depend on, and the most common errors you might see when TLS 1.2 is required but the components aren't up to date. SQL Server 2016, SQL Server 2017, SQL Server 2019, and SQL Server 2022 support TLS 1.2 natively and don't need a separate update. Out-of-mainstream versions (SQL Server 2008, 2008 R2, 2012, and 2014) need the updates listed in the tables below.

Known vulnerabilities exist for Secure Sockets Layer (SSL) and earlier versions of Transport Layer Security (TLS). Use TLS 1.2 (or TLS 1.3 where supported) for secure communication. On current Windows client and Windows Server releases, TLS 1.0 and TLS 1.1 are disabled by default, so client and server components must support TLS 1.2 or later to connect.

Check whether you need this update

Use the following table to check whether your current version of SQL Server already supports TLS 1.2 or whether you need to install an update to enable TLS 1.2 support. Use the download links in the table to get the server updates that apply to your environment.

Client component downloads

Use the following table to download the client components and driver updates that are applicable to your environment.

Client driver and provider support for TLS 1.2

The following table summarizes TLS 1.2 support across SQL Server drivers and providers:

Other fixes needed for SQL Server to use TLS 1.2

Install the following .NET hotfix rollups to let SQL Server features that rely on .NET endpoints use TLS 1.2. Examples include Database Mail and SSIS components like the Web Service task.

Frequently asked questions

Does SQL Server 2016 and later versions support TLS 1.1?

SQL Server 2016, SQL Server 2017 on Windows, SQL Server 2019 on Windows, and SQL Server 2022 support TLS 1.0 through TLS 1.2. The TLS versions that clients actually use depend on what the underlying Windows operating system enables. On current Windows releases, TLS 1.0 and TLS 1.1 are disabled by default. If you want to allow only TLS 1.2 (or later), disable the older protocols in Schannel.

Does SQL Server 2019 allow connections that use TLS 1.0 or 1.1, or only 1.2?

SQL Server 2019 has the same level of TLS support as SQL Server 2016 and SQL Server 2017. SQL Server 2019 RTM ships with TLS 1.2 support, and no other update or fix is needed to enable it. Schannel settings on the operating system control which TLS versions clients can actually use.

Is TDS affected by known vulnerabilities?

No known vulnerabilities exist for the Microsoft TDS implementation. Because several standards-enforcement organizations mandate the use of TLS 1.2 for encrypted communication channels, Microsoft is releasing support for TLS 1.2 for the widespread SQL Server installation base.

How will Microsoft distribute the TLS 1.2 updates to customers?

This article provides download links for the appropriate server and client updates that support TLS 1.2.

Does TLS 1.2 support SQL Server 2005?

TLS 1.2 support is offered only for SQL Server 2008 and later versions.

Are customers who aren't using SSL/TLS affected if SSL 3.0 and TLS 1.0 are disabled on the server?

Yes. SQL Server encrypts the user name and password during authentication even when a secure communication channel isn't otherwise used. The TLS 1.2 update is needed for any SQL Server instance where the only enabled protocol on the server is TLS 1.2.

Which versions of Windows Server support TLS 1.2?

Windows Server 2008 R2 and later versions support TLS 1.2.

What's the correct registry setting to enable TLS 1.2 for SQL Server communication?

The correct registry settings are as follows:

• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client] "DisabledByDefault"=dword:00000000 "Enabled"=dword:00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server] "DisabledByDefault"=dword:00000000 "Enabled"=dword:00000001

These settings are required for both server and client computers. The DisabledByDefault and Enabled settings are required to be created on Windows 7 clients and Windows Server 2008 R2 servers. On Windows 8 and later versions of the client operating systems or Windows Server 2012 server and later versions of the server operating systems, TLS 1.2 should already be enabled. If you're implementing a deployment policy for Windows Registry that needs to be independent of the OS release, add the mentioned registry keys to the policy.

In addition, if you're using Database Mail on your SQL Server, you also need to set the following .NET registry keys:

• [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001
• [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001

Known issues

SSMS, Report Server, and Report Manager can't connect after you apply the TLS 1.2 fix

SQL Server Management Studio (SSMS), Report Server, and Report Manager don't connect to the database engine after you apply the fix for SQL Server 2008, 2008 R2, 2012, or 2014. Report Server and Report Manager fail and return the following error message:

The report server cannot open a connection to the report server database. A connection to the database is required for all requests and processing. (rsReportServerDatabaseUnavailable)

This issue occurs because SSMS, Report Manager, and Reporting Services Configuration Manager use ADO.NET, and ADO.NET support for TLS 1.2 is available only in the .NET Framework 4.6. For earlier versions of the .NET Framework, you need to apply a Windows update so that ADO.NET can support TLS 1.2 communications for the client. The Windows updates that enable TLS 1.2 support in earlier versions of the .NET framework are listed in the table in the Check whether you need this update section.

Reporting Services Configuration Manager pre-login handshake fails

Reporting Services Configuration Manager reports the following error message even after you update client providers to a version that supports TLS 1.2:

Could not connect to server: A connection was successfully established to the server, but then an error occurred during the pre-login handshake.

To fix this problem, manually create the following registry key on the system that hosts the Reporting Services Configuration Manager:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client: "Enabled"=dword:00000001

Encrypted endpoint communication fails for Availability Groups, Database Mirroring, or Service Broker

The encrypted endpoint communication that uses TLS 1.2 fails when you use encrypted communications for Availability Groups, Database Mirroring, or Service Broker in SQL Server. An error message that resembles the following one is logged in the SQL error log:

Connection handshake failed. An OS call failed: (80090331) 0x80090331(The client and server cannot communicate, because they do not possess a common algorithm.). State 56.

For more information about this issue, see FIX: The encrypted endpoint communication with TLS 1.2 fails when you use SQL Server.

Errors when you install SQL Server 2012 or 2014 with TLS 1.2 enabled

Different errors occur when you try to install SQL Server 2012 or SQL Server 2014 on a server that has TLS 1.2 enabled.

For more information, see FIX: Error when you install SQL Server 2012 or SQL Server 2014 on a server that has TLS 1.2 enabled.

Encrypted connection for Database Mirroring or Availability Groups fails with an MD5 certificate

An encrypted connection with Database Mirroring or Availability Groups doesn't work when you use a certificate after you disable all other protocols other than TLS 1.2. You might see one or both of the following error messages.

An error message that resembles the following one is logged in the SQL Server error log:

Connection handshake failed. An OS call failed: (80090331) 0x80090331(The client and server cannot communicate, because they do not possess a common algorithm.). State 58.'

An error message that resembles the following one is logged in the Windows event log:

Log Name:      System
Source:        Schannel
Date:          <Date Time>
Event ID:      36888
Task Category: None
Level:         Error
Keywords:     
User:          SYSTEM
Computer:      ------------
Description:
A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 40. The Windows SChannel error state is 1205.

Log Name:      System
Source:        Schannel
Date:          <Date Time>
Event ID:      36874
Task Category: None
Level:         Error
Keywords:     
User:          SYSTEM
Computer:      -----------
Description:
An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.

This issue occurs because Availability Groups and Database Mirroring require a certificate that doesn't use fixed length hash algorithms, such as MD5. Fixed length hashing algorithms aren't supported in TLS 1.2.

For more information, see FIX: Communication using MD5 hash algorithm fails if SQL Server uses TLS 1.2.

Intermittent SQL Server service termination on SQL Server 2008 and 2008 R2

The following SQL Server database engine versions are affected by the intermittent service termination issue that's reported in Knowledge Base article 3146034. To protect yourself from the service termination issue, install the TLS 1.2 updates for SQL Server that are mentioned in this article if your SQL Server version is listed in the following table:

Database Mail doesn't work with TLS 1.2

Database Mail fails with the following error:

Microsoft.SqlServer.Management.SqlIMail.Server.Common.BaseException: Mail configuration information could not be read from the database. Unable to start mail session.

For more information, see Other fixes needed for SQL Server to use TLS 1.2.

SCCM can't connect to SQL Server after TLS 1.2 is enabled

System Center Configuration Manager (SCCM) can't connect to SQL Server after the TLS 1.2 protocol is enabled on SQL Server. In this situation, you get the following error message:

TCP Provider: An existing connection was forcibly closed by the remote host

This issue might occur when SCCM uses a SQL Server Native Client driver that doesn't have a fix. To fix this issue, download and install the client fix that's listed in the Client component downloads section. For example, Microsoft SQL Server 2012 Native Client - QFE.

You can find out which driver SCCM is using to connect to SQL Server by viewing the SCCM log, as shown in the following example:

[SQL Server Native Client 11.0]TCP Provider: An existing connection was forcibly closed by the remote host.~~  $$<Configuration Manager Setup><08-22-2016 04:15:01.917+420><thread=2868 (0xB34)>
 *** [08001][10054][Microsoft][SQL Server Native Client 11.0]Client unable to establish connection  $$<Configuration Manager Setup><08-22-2016 04:15:01.917+420><thread=2868 (0xB34)>
 *** Failed to connect to the SQL Server, connection type: SMS ACCESS.  $$<Configuration Manager Setup><08-22-2016 04:15:01.917+420><thread=2868 (0xB34)>
 INFO: SQL Connection failed. Connection: SMS ACCESS, Type: Secure  $$<Configuration Manager Setup><08-22-2016 04:15:01.917+420><thread=2868 (0xB34)>Native Client 11.0]TCP Provider: An existing connection was forcibly closed by the remote host.~~  $$<Configuration Manager Setup><08-22-2016 04:15:01.917+420><thread=2868 (0xB34)>
 *** [08001][10054][Microsoft][SQL Server Native Client 11.0]Client unable to establish connection  $$<Configuration Manager Setup><08-22-2016 04:15:01.917+420><thread=2868 (0xB34)>
 *** Failed to connect to the SQL Server, connection type: SMS ACCESS.  $$<Configuration Manager Setup><08-22-2016 04:15:01.917+420><thread=2868 (0xB34)>
 INFO: SQL Connection failed. Connection: SMS ACCESS, Type: Secure  $$<Configuration Manager Setup><08-22-2016 04:15:01.917+420><thread=2868 (0xB34)>