Skip to content

Error Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 31 - Encryption(ssl/tls) handshake failed) #633

Closed
Closed
Error Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 31 - Encryption(ssl/tls) handshake failed)#633

Description

@machoubie
machoubie
opened on Jul 3, 2020

Hi,
I am faced the issue bellow when trying connection From .net core container to windows mssql .

Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 31 - Encryption(ssl/tls) handshake failed)
---> System.IO.EndOfStreamException: End of stream reached
at Microsoft.Data.SqlClient.SNI.SslOverTdsStream.ReadInternal(Byte[] buffer, Int32 offset, Int32 count, CancellationToken token, Boolean async)
at Microsoft.Data.SqlClient.SNI.SslOverTdsStream.Read(Byte[] buffer, Int32 offset, Int32 count)
at System.Net.FixedSizeReader.ReadPacket(Stream transport, Byte[] buffer, Int32 offset, Int32 count)
at System.Net.Security.SslStream.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslStream.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslStream.ProcessAuthentication(LazyAsyncResult lazyResult, CancellationToken cancellationToken)
at System.Net.Security.SslStream.AuthenticateAsClient(SslClientAuthenticationOptions sslClientAuthenticationOptions)
at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost)
at Microsoft.Data.SqlClient.SNI.SNITCPHandle.EnableSsl(UInt32 options)
at Microsoft.Data.SqlClient.SNI.SNIProxy.EnableSsl(SNIHandle handle, UInt32 options)
at Microsoft.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action1 wrapCloseInAction) at Microsoft.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) at Microsoft.Data.SqlClient.TdsParser.ConsumePreLoginHandshake(Boolean encrypt, Boolean trustServerCert, Boolean integratedSecurity, Boolean& marsCapable, Boolean& fedAuthRequired) at Microsoft.Data.SqlClient.TdsParser.Connect(ServerInfo serverInfo, SqlInternalConnectionTds connHandler, Boolean ignoreSniOpenTimeout, Int64 timerExpire, Boolean encrypt, Boolean trustServerCert, Boolean integratedSecurity, Boolean withFailover, SqlAuthenticationMethod authType) at Microsoft.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, SecureString newSecurePassword, Boolean ignoreSniOpenTimeout, TimeoutTimer timeout, Boolean withFailover) at Microsoft.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(ServerInfo serverInfo, String newPassword, SecureString newSecurePassword, Boolean redirectedUserInstance, SqlConnectionString connectionOptions, SqlCredential credential, TimeoutTimer timeout) at Microsoft.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(TimeoutTimer timeout, SqlConnectionString connectionOptions, SqlCredential credential, String newPassword, SecureString newSecurePassword, Boolean redirectedUserInstance) at Microsoft.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, SqlCredential credential, Object providerInfo, String newPassword, SecureString newSecurePassword, Boolean redirectedUserInstance, SqlConnectionString userConnectionOptions, SessionData reconnectSessionData, Boolean applyTransientFaultHandling, String accessToken, DbConnectionPool pool) at Microsoft.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, DbConnectionPoolKey poolKey, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection, DbConnectionOptions userOptions) at Microsoft.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnectionPool pool, DbConnection owningObject, DbConnectionOptions options, DbConnectionPoolKey poolKey, DbConnectionOptions userOptions) at Microsoft.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject, DbConnectionOptions userOptions, DbConnectionInternal oldConnection) at Microsoft.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject, DbConnectionOptions userOptions, DbConnectionInternal oldConnection) at Microsoft.Data.ProviderBase.DbConnectionPool.TryGetConnection(DbConnection owningObject, UInt32 waitForMultipleObjectsTimeout, Boolean allowCreate, Boolean onlyOneCheckConnection, DbConnectionOptions userOptions, DbConnectionInternal& connection) at Microsoft.Data.ProviderBase.DbConnectionPool.TryGetConnection(DbConnection owningObject, TaskCompletionSource1 retry, DbConnectionOptions userOptions, DbConnectionInternal& connection)
at Microsoft.Data.ProviderBase.DbConnectionFactory.TryGetConnection(DbConnection owningConnection, TaskCompletionSource1 retry, DbConnectionOptions userOptions, DbConnectionInternal oldConnection, DbConnectionInternal& connection) at Microsoft.Data.ProviderBase.DbConnectionInternal.TryOpenConnectionInternal(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions)
at Microsoft.Data.ProviderBase.DbConnectionClosed.TryOpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions) at Microsoft.Data.SqlClient.SqlConnection.TryOpen(TaskCompletionSource1 retry, SqlConnectionOverrides overrides)
at Microsoft.Data.SqlClient.SqlConnection.Open(SqlConnectionOverrides overrides)
at Microsoft.Data.SqlClient.SqlConnection.Open()
at Microsoft.EntityFrameworkCore.Storage.RelationalConnection.OpenDbConnection(Boolean errorsExpected)
at Microsoft.EntityFrameworkCore.Storage.RelationalConnection.Open(Boolean errorsExpected)
at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject)
at Microsoft.EntityFrameworkCore.Query.Internal.QueryingEnumerable1.Enumerator.InitializeReader(DbContext _, Boolean result) at Microsoft.EntityFrameworkCore.SqlServer.Storage.Internal.SqlServerExecutionStrategy.Execute[TState,TResult](TState state, Func3 operation, Func3 verifySucceeded) at Microsoft.EntityFrameworkCore.Query.Internal.QueryingEnumerable1.Enumerator.MoveNext()
at System.Linq.Enumerable.Single[TSource](IEnumerable`1 source)
at TEST.Api.DAL.EnqueuingToDb.DbMilor2Context.EnqueueData(ApiCallIdentification metadatas, String json) in /src/TEST/DAL/EnqueuingToDb/DbMilor2Context.cs:line 57
at TEST.Api.Business.EnqueuingToDb.Enqueuing.Create() in /src/TEST/Business/EnqueuingToDb/Enqueuing.cs:line 51
at TEST.Api.Models.ActionFilters.DataEnqueuingFilterAttribute.OnActionExecuting(ActionExecutingContext context) in /src/TEST/Models/ActionFilters/DataEnqueuingFilter.cs:line 109
at Microsoft.AspNetCore.Mvc.Filters.ActionFilterAttribute.OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()
--- End of stack trace from previous location where exception was thrown ---
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|25_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
ClientConnectionId:490aab56-2f44-4824-b5a1-907042f6e801 Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 31 - Encryption(ssl/tls) handshake failed)

Docker version:
Client: Docker Engine - Community
Version: 19.03.12
API version: 1.40
Go version: go1.13.10
Git commit: 48a66213fe
Built: Mon Jun 22 15:45:36 2020
OS/Arch: linux/amd64
Experimental: false

Server: Docker Engine - Community
Engine:
Version: 19.03.12
API version: 1.40 (minimum version 1.12)
Go version: go1.13.10
Git commit: 48a66213fe
Built: Mon Jun 22 15:44:07 2020
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.2.13
GitCommit: 7ad184331fa3e55e52b890ea95e65ba581ae3429
runc:
Version: 1.0.0-rc10
GitCommit: dc9208a3303feef5b3839f4323d9beb36df0a9dd
docker-init:
Version: 0.18.0
GitCommit: fec3683

Host info :
Kernel Version: 5.3.0-1031-azure
Operating System: Ubuntu 18.04.4 LTS
OSType: linux
Architecture: x86_64

Connection String :

Data Source=TESTSERVER2INT\TESTSQL02INT,52810;Initial Catalog=Test;User ID=test_user;Password=****;Integrated Security=False

Thank you in advance for your Help

Activity

  1. karinazhou commented on Jul 3, 2020

    @karinazhou
    karinazhou
    on Jul 3, 2020
    Member

    Hi @machoubie ,

    From the docker info, it's hard to tell what SQL server version you are using. Could you provide more information about your server? And what docker images you are using? Is the Ubuntu 18.04 OS the actual system or the docker container you are using to connect to the server?

    I assume that you are using the Microsoft.Data.SqlClient v2.0.0 because you have seen the "End of stream reached" error message which is recently introduced by PR 577. This error may be related to Server certificate force encryption #609 or lower TLS version used by the server (quote from 201).

    You can check the following settings first on your side:

    1. Check if the SQL Server has Force Encryption as YES.
    2. If yes, add Trust Server Certificate = true in your connection string or Set Force Encryption to NO.

    If the above two steps don't solve your issue, you may face a similar case when your server is using lower version of TLS. If possible, you can try to write a simple .NET core application to connect to your target server and see if you get warning message like Security Warning: The negotiated TLS1.0 is an insecure protocol and is supported for backward compatibility only. The recommended protocol version is TLS 1.2 and later. If you see such warning, either your server or your client environment is using lower TLS version to communicate with the other.

  2. madhon commented on Jul 6, 2020

    @madhon
    madhon
    on Jul 6, 2020

    I have exactly the same issue, all i did was update the package from 1.1.3 to 2.0.0 ... it then broke, downgrading back to 1.1.3 made it work again. This leads me to believe its not SQL Server at fault, its the sqlclient package

  3. madhon commented on Jul 6, 2020

    @madhon
    madhon
    on Jul 6, 2020

    ee the end of this message for details on invoking
    just-in-time (JIT) debugging instead of this dialog box.

    ************** Exception Text **************
    Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: Shared Memory Provider, error: 36 - The Shared Memory dll used to connect to SQL Server 2000 was not found) ---> System.ComponentModel.Win32Exception (0x80004005): The system cannot find the file specified
    at Microsoft.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action1 wrapCloseInAction) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\SqlInternalConnection.cs:line 779 at Microsoft.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\TdsParser.cs:line 1668 at Microsoft.Data.SqlClient.TdsParser.ConsumePreLoginHandshake(SqlAuthenticationMethod authType, Boolean encrypt, Boolean trustServerCert, Boolean integratedSecurity, ServerCertificateValidationCallback serverCallback, ClientCertificateRetrievalCallback clientCallback, Boolean& marsCapable, Boolean& fedAuthRequired) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\TdsParser.cs:line 1293 at Microsoft.Data.SqlClient.TdsParser.Connect(ServerInfo serverInfo, SqlInternalConnectionTds connHandler, Boolean ignoreSniOpenTimeout, Int64 timerExpire, Boolean encrypt, Boolean trustServerCert, Boolean integratedSecurity, Boolean withFailover, Boolean isFirstTransparentAttempt, SqlAuthenticationMethod authType, String certificate, ServerCertificateValidationCallback serverCallback, ClientCertificateRetrievalCallback clientCallback, Boolean useOriginalAddressInfo, Boolean disableTnir) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\TdsParser.cs:line 640 at Microsoft.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, SecureString newSecurePassword, Boolean ignoreSniOpenTimeout, TimeoutTimer timeout, Boolean withFailover, Boolean isFirstTransparentAttempt, Boolean disableTnir) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\SqlInternalConnectionTds.cs:line 2251 at Microsoft.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(ServerInfo serverInfo, String newPassword, SecureString newSecurePassword, Boolean redirectedUserInstance, SqlConnectionString connectionOptions, SqlCredential credential, TimeoutTimer timeout) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\SqlInternalConnectionTds.cs:line 1873 at Microsoft.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(TimeoutTimer timeout, SqlConnectionString connectionOptions, SqlCredential credential, String newPassword, SecureString newSecurePassword, Boolean redirectedUserInstance) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\SqlInternalConnectionTds.cs:line 1685 at Microsoft.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, SqlCredential credential, Object providerInfo, String newPassword, SecureString newSecurePassword, Boolean redirectedUserInstance, SqlConnectionString userConnectionOptions, SessionData reconnectSessionData, ServerCertificateValidationCallback serverCallback, ClientCertificateRetrievalCallback clientCallback, DbConnectionPool pool, String accessToken, SqlClientOriginalNetworkAddressInfo originalNetworkAddressInfo, Boolean applyTransientFaultHandling) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\SqlInternalConnectionTds.cs:line 536 at Microsoft.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, DbConnectionPoolKey poolKey, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection, DbConnectionOptions userOptions) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\SqlConnectionFactory.cs:line 143 at Microsoft.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnectionPool pool, DbConnection owningObject, DbConnectionOptions options, DbConnectionPoolKey poolKey, DbConnectionOptions userOptions) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\ProviderBase\DbConnectionFactory.cs:line 163 at Microsoft.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject, DbConnectionOptions userOptions, DbConnectionInternal oldConnection) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\ProviderBase\DbConnectionPool.cs:line 943 at Microsoft.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject, DbConnectionOptions userOptions, DbConnectionInternal oldConnection) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\ProviderBase\DbConnectionPool.cs:line 2000 at Microsoft.Data.ProviderBase.DbConnectionPool.TryGetConnection(DbConnection owningObject, UInt32 waitForMultipleObjectsTimeout, Boolean allowCreate, Boolean onlyOneCheckConnection, DbConnectionOptions userOptions, DbConnectionInternal& connection) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\ProviderBase\DbConnectionPool.cs:line 1412 at Microsoft.Data.ProviderBase.DbConnectionPool.TryGetConnection(DbConnection owningObject, TaskCompletionSource1 retry, DbConnectionOptions userOptions, DbConnectionInternal& connection) in H:\tsaagent2_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\ProviderBase\DbConnectionPool.cs:line 1296
    at Microsoft.Data.ProviderBase.DbConnectionFactory.TryGetConnection(DbConnection owningConnection, TaskCompletionSource1 retry, DbConnectionOptions userOptions, DbConnectionInternal oldConnection, DbConnectionInternal& connection) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\ProviderBase\DbConnectionFactory.cs:line 354 at Microsoft.Data.ProviderBase.DbConnectionInternal.TryOpenConnectionInternal(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions) in H:\tsaagent2_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\ProviderBase\DbConnectionInternal.cs:line 766
    at Microsoft.Data.ProviderBase.DbConnectionClosed.TryOpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\ProviderBase\DbConnectionClosed.cs:line 71 at Microsoft.Data.SqlClient.SqlConnection.TryOpenInner(TaskCompletionSource1 retry) in H:\tsaagent2_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\SqlConnection.cs:line 1946
    at Microsoft.Data.SqlClient.SqlConnection.TryOpen(TaskCompletionSource1 retry, SqlConnectionOverrides overrides) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\SqlConnection.cs:line 1934 at Microsoft.Data.SqlClient.SqlConnection.Open(SqlConnectionOverrides overrides) in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\SqlConnection.cs:line 1495 at Microsoft.Data.SqlClient.SqlConnection.Open() in H:\tsaagent2\_work\11\s\src\Microsoft.Data.SqlClient\netfx\src\Microsoft\Data\SqlClient\SqlConnection.cs:line 1466 at Dapper.SqlMapper.<QueryImpl>d__1401.MoveNext() in //Dapper/SqlMapper.cs:line 1078
    at System.Collections.Generic.List1..ctor(IEnumerable1 collection)
    at System.Linq.Enumerable.ToList[TSource](IEnumerable1 source) at Dapper.SqlMapper.Query[T](IDbConnection cnn, String sql, Object param, IDbTransaction transaction, Boolean buffered, Nullable1 commandTimeout, Nullable`1 commandType) in /    /Dapper/SqlMapper.cs:line 721
    at WindowsFormsApp1.Form1.LoadLeadButton_Click(Object sender, EventArgs e) in M:\development\R1\R1\WindowsFormsApp1\Form1.cs:line 21
    at System.Windows.Forms.Control.OnClick(EventArgs e)
    at System.Windows.Forms.Button.OnClick(EventArgs e)
    at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
    at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
    at System.Windows.Forms.Control.WndProc(Message& m)
    at System.Windows.Forms.ButtonBase.WndProc(Message& m)
    at System.Windows.Forms.Button.WndProc(Message& m)
    at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
    at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
    at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
    ClientConnectionId:67e04f97-acbb-48e7-a4d7-918df00c2e58
    Error Number:2,State:0,Class:20

    ************** Loaded Assemblies **************
    mscorlib
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4180.0 built by: NET48REL1LAST_B
    CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll

    WindowsFormsApp1
    Assembly Version: 1.0.0.0
    Win32 Version: 1.0.0.0
    CodeBase: file:///M:/development/R1/R1/WindowsFormsApp1/bin/Debug/WindowsFormsApp1.exe

    System.Windows.Forms
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4084.0 built by: NET48REL1
    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll

    System
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4084.0 built by: NET48REL1
    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll

    System.Drawing
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4084.0 built by: NET48REL1
    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll

    System.Configuration
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4084.0 built by: NET48REL1
    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll

    System.Core
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4180.0 built by: NET48REL1LAST_B
    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll

    System.Xml
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4084.0 built by: NET48REL1
    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll

    System.Data
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4084.0 built by: NET48REL1
    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_32/System.Data/v4.0_4.0.0.0__b77a5c561934e089/System.Data.dll

    Microsoft.Data.SqlClient
    Assembly Version: 2.0.20168.4
    Win32 Version: 2.00.20168.4
    CodeBase: file:///M:/development/R1/R1/WindowsFormsApp1/bin/Debug/Microsoft.Data.SqlClient.DLL

    System.Transactions
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4084.0 built by: NET48REL1
    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_32/System.Transactions/v4.0_4.0.0.0__b77a5c561934e089/System.Transactions.dll

    Dapper
    Assembly Version: 2.0.0.0
    Win32 Version: 2.0.35.21366
    CodeBase: file:///M:/development/R1/R1/WindowsFormsApp1/bin/Debug/Dapper.DLL

    System.Xml.Linq
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4084.0 built by: NET48REL1
    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Xml.Linq/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.Linq.dll

    System.EnterpriseServices
    Assembly Version: 4.0.0.0
    Win32 Version: 4.8.4084.0 built by: NET48REL1
    CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_32/System.EnterpriseServices/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.EnterpriseServices.dll

    ************** JIT Debugging **************
    To enable just-in-time (JIT) debugging, the .config file for this
    application or computer (machine.config) must have the
    jitDebugging value set in the system.windows.forms section.
    The application must also be compiled with debugging
    enabled.

    For example:

    When JIT debugging is enabled, any unhandled exception
    will be sent to the JIT debugger registered on the computer
    rather than be handled by this dialog box.

  4. ErikEJ commented on Jul 6, 2020

    @ErikEJ
    ErikEJ
    on Jul 6, 2020
    Contributor

    @madhon It is a documented breaking change in the 2.0 provider, yes. https://erikej.github.io/sqlclient/efcore/2020/06/22/sqlclient-2-breaking-changes.html

  5. madhon commented on Jul 6, 2020

    @madhon
    madhon
    on Jul 6, 2020

    @madhon It is a documented breaking change in the 2.0 provider, yes. https://erikej.github.io/sqlclient/efcore/2020/06/22/sqlclient-2-breaking-changes.html

    Why would that connection string value be force required now ? Its effectively saying trust the certificate regardless of if it verifies up to a trusted root certificate or not ?

    I was under the impression that parameter was only to override untrusted certificates ?

  6. madhon commented on Jul 6, 2020

    @madhon
    madhon
    on Jul 6, 2020

    The equivalent of the following code to override trust of certs when accessing web apis/sites

    ServicePointManager
    .ServerCertificateValidationCallback +=
    (sender, cert, chain, sslPolicyErrors) => true;

  7. machoubie commented on Jul 6, 2020

    @machoubie
    machoubie
    on Jul 6, 2020
    Author

    @karinazhou i am using dotnet/core/aspnet:3.0-buster-slim docker image to run my apps , the tests you suggest don't work for me
    the sql server version is 2016

  8. machoubie commented on Jul 6, 2020

    @machoubie
    machoubie
    on Jul 6, 2020
    Author

    another thing, when i add Encrypt=False to my connectionString , the sqlclient still use ssl for th connection

  9. cheenamalhotra commented on Jul 6, 2020

    @cheenamalhotra
    cheenamalhotra
    on Jul 6, 2020
    Member

    @machoubie

    Please ensure your server is not enforcing SSL if it's an on-premise SQL Server, see comment here: #609 (comment)

  10. machoubie commented on Jul 6, 2020

    @machoubie
    machoubie
    on Jul 6, 2020
    Author

    I confirm that the server is not enforcing ssl

  11. madhon commented on Jul 6, 2020

    @madhon
    madhon
    on Jul 6, 2020

    Ours isn’t enforcing either

  12. cheenamalhotra commented on Jul 6, 2020

    @cheenamalhotra
    cheenamalhotra
    on Jul 6, 2020
    Member

    Ok, I got a bit confused in discussions above.

    To clarify, SSL/TLS handshake is always performed never-the-less client requests encryption, it's part of login flow. But, whether the stream is going to be encrypted and certificates are validated are not, depends on client/server settings where "Force Encryption" plays a role, which doesn't seem to be the case here.

    Also, I see two different stack traces in above discussions:
    Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 31 - Encryption(ssl/tls) handshake failed) ---> System.IO.EndOfStreamException: End of stream reached
    and
    Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: Shared Memory Provider, error: 36 - The Shared Memory dll used to connect to SQL Server 2000 was not found) ---> System.ComponentModel.Win32Exception (0x80004005): The system cannot find the file specified (Not possible on Linux as mentioned in the issue description)

    If both issues are different, let's stick to issue in description first.

    @machoubie provider: SSL Provider, error: 31 .. System.IO.EndOfStreamException: End of stream reached issue is possible, when client does not support TLS 1.0/1.1 versions whereas Server does not support TLS 1.2 > leading to server not responding to client's request as no "trust" is established. To fix this error, you need to ensure TLS 1.2 is enabled on Server and is available to be used to connect. If you are not sure it is enabled, you can connect from a Windows client where lower TLS versions are enabled and verify if a lower TLS protocol version is negotiated by looking at "warning" thrown by driver.

    @madhon On the other hand, for stack trace regarding "provider: Shared Memory Provider, error: 36" , we'll need more details regarding your environment setup and how can we reproduce this issue?

  13. karinazhou commented on Jul 6, 2020

    @karinazhou
    karinazhou
    on Jul 6, 2020
    Member

    @machoubie According to what @cheenamalhotra has suggested, your issue looks similar to this one #201 . I can see some other users facing the same issue due to TLS version mismatching. Probably, your Debian image is using TLS 1.2 by default while your server is using a lower TLS version. If you can confirm that your SQL Server is using old TLS version, for example, by connecting from a Windows application and check the TLS version warning message. You can either enable TLS 1.2 on your SQL Server or try some suggestions like switching to a 3.0-bionic image (Ubuntu 18.04) if possible or bring back the minimal TLS support version on Debian if upgrading server's TLS version is not an option for you. Other ways you can also try :
    #201 (comment)
    #201 (comment)

    And here is the link about how to enable TLS 1.2 on SQL Server.

  14. goolzerg commented on Jul 7, 2020

    @goolzerg
    goolzerg
    on Jul 7, 2020

    @machoubie According to what @cheenamalhotra has suggested, your issue looks similar to this one #201 . I can see some other users facing the same issue due to TLS version mismatching. Probably, your Debian image is using TLS 1.2 by default while your server is using a lower TLS version. If you can confirm that your SQL Server is using old TLS version, for example, by connecting from a Windows application and check the TLS version warning message. You can either enable TLS 1.2 on your SQL Server or try some suggestions like switching to a 3.0-bionic image (Ubuntu 18.04) if possible or bring back the minimal TLS support version on Debian if upgrading server's TLS version is not an option for you. Other ways you can also try :
    #201 (comment)
    #201 (comment)

    And here is the link about how to enable TLS 1.2 on SQL Server.

    +1 It worked for me. I've changed the minimal TLS version to 1.0

  15. arthurdelduque commented on Jul 8, 2020

    @arthurdelduque
    arthurdelduque
    on Jul 8, 2020

    +1 It worked for me. I've changed the minimal TLS version to 1.0

  16. 23 remaining items

  17. JRahnama commented on Nov 8, 2022

    @JRahnama
    JRahnama
    on Nov 8, 2022
    Contributor

    @sayago69 have you tried adding Encrypt = false to your connection string?

  18. sayago69 commented on Nov 9, 2022

    @sayago69
    sayago69
    on Nov 9, 2022

    Yes, we have tried with both Encrypt=false and Encrypt=true and still not working. It keeps using TLS 1.0.

    However, I think we have managed to find a solution: we have added this bit RUN sed -i 's/TLSv1.2/TLSv1.0/g' /etc/ssl/openssl.cnf to the docker file, but not at the end but just at the beginning just after the Expose clauses:

    FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app
EXPOSE 8080
EXPOSE 443
RUN sed -i 's/TLSv1.2/TLSv1.0/g' /etc/ssl/openssl.cnf

    After adding that line, we started getting a slightly different error:

    Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 35 - An internal exception was caught)
---> System.Security.Authentication.AuthenticationException: The remote certificate was rejected by the provided RemoteCertificateValidationCallback.

    Then, we made it work just by adding Trust Server Certificate=true; to our connecting string:

    Server=myDatabaseServerUrl;Database=MyDatabase;User Id=sa;Password=mysecurepassword;Trust Server Certificate=true;

    Hope it might help someone else.

  19. felopezm commented on Nov 9, 2022

    @felopezm
    felopezm
    on Nov 9, 2022

    @sayago69 Your answer worked for me, additionally add the 'Encrypt=False' in the connection string. Thank you

  20. sayago69 commented on Nov 9, 2022

    @sayago69
    sayago69
    on Nov 9, 2022

    @sayago69 Your answer worked for me, additionally add the 'Encrypt=False' in the connection string. Thank you

    You're welcome.

    Unfortunately, that solution fixed our API's connection to SQL Server but broke our API's connection to RabbitMQ which only accepts TLS1.2 as far as I'm aware.

    Still trying to understand why changing the minimum protocol in openssl.cnf to 1.0 is making it work if both the API and SQL Server are eventually handshaking using TLS 1.2. Why didn't they do it before when the minimum protocol was TLS1.2? We must have changed something else in that file.

    Anyway, we'll keep investigating...

  21. sayago69 commented on Nov 11, 2022

    @sayago69
    sayago69
    on Nov 11, 2022

    Well, it seems we have finally managed to figure out a lasting solution to this problem. We just added the following line to our docker file just after the EXPOSE lines:

    FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app
EXPOSE 8080
EXPOSE 443
RUN sed -i 's/CipherString = DEFAULT@SECLEVEL=2/CipherString = DEFAULT@SECLEVEL=1/g' /etc/ssl/openssl.cnf

    Note that this is just one of the lines suggested by @inlineHamed earlier but in a different place in the docker file. We started adding those two lines (and worked) but we figured out that the second line was enough. It didn't work fine with only the first line.

    Also, our connection to the database doesn't need Trust Server Certificate=true anymore.

    Once again, hope this may help someone else.

  22. LaXiS96 commented on Feb 15, 2023

    @LaXiS96
    LaXiS96
    on Feb 15, 2023

    As of today, the aspnet:6.0 Docker image has this weird behaviour: setting MinProtocol to TLSv1.0 (which was working on aspnet:3.1) results in an exception similar to the original post, but simply changing the value to TLSv1 instead fixes the issue.
    CipherString still needs to be set to DEFAULT@SECLEVEL=1.

  23. GaTechThomas commented on Apr 9, 2023

    @GaTechThomas
    GaTechThomas
    on Apr 9, 2023

    I was having the same problem and this issue thread helped me to solve it. Simply adding the following to the connection string solved it:

    ;TrustServerCertificate=true

  24. garrettsutula commented on Dec 13, 2023

    @garrettsutula
    garrettsutula
    on Dec 13, 2023

    As of today, the aspnet:6.0 Docker image has this weird behaviour: setting MinProtocol to TLSv1.0 (which was working on aspnet:3.1) results in an exception similar to the original post, but simply changing the value to TLSv1 instead fixes the issue. CipherString still needs to be set to DEFAULT@SECLEVEL=1.

    Thanks, this saved me a bunch of time today but the configuration blocks for this aren't present in latest /etc/ssl/openssl.cnf in the MS container images I am working with so I followed this guide on how to set up the right config objects to pass min protocol and cipher string settings.

  25. Mehranh commented on Dec 15, 2023

    @Mehranh
    Mehranh
    on Dec 15, 2023

    Unfortunately that does not solve for .Net 8

    On mcr.microsoft.com/dotnet/aspnet:6.0 docker image, this worked for me:

    RUN sed -i 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /etc/ssl/openssl.cnf
RUN sed -i 's/CipherString = DEFAULT@SECLEVEL=2/CipherString = DEFAULT@SECLEVEL=1/g' /etc/ssl/openssl.cnf

  26. amingolmahalle commented on Dec 31, 2023

    @amingolmahalle
    amingolmahalle
    on Dec 31, 2023

    @Mehranh please visit the link below:
    https://github.com/dotnet/SqlClient/issues/2252#issuecomment-1872966588

  27. pramahamuni commented on Jan 29, 2025

    @pramahamuni
    pramahamuni
    on Jan 29, 2025

    @Mehranh, did you manage to find a solution? The solution provided earlier didn’t work for my application in .NET 8 either

    RUN sed -i 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /etc/ssl/openssl.cnf
RUN sed -i 's/CipherString = DEFAULT@SECLEVEL=2/CipherString = DEFAULT@SECLEVEL=1/g' /etc/ssl/openssl.cnf

  28. nikolaphilipp commented on Feb 13, 2025

    @nikolaphilipp
    nikolaphilipp
    on Feb 13, 2025

    For everybody using a .NET 8 based container build:

    The solution is still more or less the same. However, the openssl version was updated in the new base images, and as of openssl v3 the necessary configuration changes are not the same anymore.

    These are the new commands which I have added directly below FROM in the base stage:

    RUN sed -i '/\[openssl_init\]/a ssl_conf = ssl_configuration' /etc/ssl/openssl.cnf

RUN echo "\n[ssl_configuration]" >> /etc/ssl/openssl.cnf \
    && echo "system_default = tls_system_default" >> /etc/ssl/openssl.cnf

RUN echo "\n[tls_system_default]" >> /etc/ssl/openssl.cnf \
    && echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf \
    && echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf

    DEFAULT@SECLEVEL=1 switched to 0 and the sections have been restructured a little. MinProtocol and CipherString no longer exist in the default config, so the old replace commands are not enough.

    Credits for the solution and more info on the topic go to Ilia on Stackoverflow

    I hope this helps others who stumble upon this thread :)

  29. ach4ndi commented on Feb 21, 2025

    @ach4ndi
    ach4ndi
    on Feb 21, 2025

    For everybody using a .NET 8 based container build:

    The solution is still more or less the same. However, the openssl version was updated in the new base images, and as of openssl v3 the necessary configuration changes are not the same anymore.

    These are the new commands which I have added directly below FROM in the base stage:

    RUN sed -i '/\[openssl_init\]/a ssl_conf = ssl_configuration' /etc/ssl/openssl.cnf

RUN echo "\n[ssl_configuration]" >> /etc/ssl/openssl.cnf \
    && echo "system_default = tls_system_default" >> /etc/ssl/openssl.cnf

RUN echo "\n[tls_system_default]" >> /etc/ssl/openssl.cnf \
    && echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf \
    && echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf

    DEFAULT@SECLEVEL=1 switched to 0 and the sections have been restructured a little. MinProtocol and CipherString no longer exist in the default config, so the old replace commands are not enough.

    Credits for the solution and more info on the topic go to Ilia on Stackoverflow

    I hope this helps others who stumble upon this thread :)

    still not working on dotnet 8.0 container.

  30. tonyverdin commented on Feb 25, 2025

    @tonyverdin
    tonyverdin
    on Feb 25, 2025

    I put this right before the entrypoint in my docker file in .net8.0 container and it works.
    ``RUN sed -i '/[openssl_init]/a ssl_conf = ssl_configuration' /etc/ssl/openssl.cnf

    RUN echo "\n[ssl_configuration]" >> /etc/ssl/openssl.cnf
    && echo "system_default = tls_system_default" >> /etc/ssl/openssl.cnf

    RUN echo "\n[tls_system_default]" >> /etc/ssl/openssl.cnf
    && echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf
    && echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf``

  31. kl-tie commented on Jul 14, 2025

    @kl-tie
    kl-tie
    on Jul 14, 2025

    It seems the /etc/ssl/openssl.cnf in the base image used for .NET 8, which is mcr.microsoft.com/dotnet/aspnet:8.0, doesn't contains [openssl_init] section, so we must add that section first in my case:

    RUN echo "\n[openssl_init]" >> /etc/ssl/openssl.cnf
RUN sed -i '/[openssl_init]/a ssl_conf = ssl_configuration' /etc/ssl/openssl.cnf

RUN echo "\n[ssl_configuration]" >> /etc/ssl/openssl.cnf \
    && echo "system_default = tls_system_default" >> /etc/ssl/openssl.cnf

RUN echo "\n[tls_system_default]" >> /etc/ssl/openssl.cnf
    && echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf \
    && echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf``
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions