Dotnet-docker: Suggest to change MinProtocol to be TLSv1.0 in /etc/ssl/openssl.cnf

[cnblogs-dudu]

If running an asp.net core 3.0 preview 5 application to connect a SQL Server 2008 R2 server with the mcr.microsoft.com/dotnet/core/aspnet:3.0 image , get the "routines:ssl_choose_client_version:unsupported protocol" errors.

System.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 35 - An internal exception was caught) ---> System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception. ---> Interop+OpenSsl+SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL. ---> Interop+Crypto+OpenSslCryptographicException: error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol
   --- End of inner exception stack trace ---
   at Interop.OpenSsl.DoSslHandshake(SafeSslHandle context, Byte[] recvBuf, Int32 recvOffset, Int32 recvCount, Byte[]& sendBuf, Int32& sendCount)
   at System.Net.Security.SslStreamPal.HandshakeInternal(SafeFreeCredentials credential, SafeDeleteContext& context, ArraySegment`1 inputBuffer, Byte[]& outputBuffer, SslAuthenticationOptions sslAuthenticationOptions)

Changing MinProtocol from TLSv1.2 to TLSv1.0 in /etc/ssl/openssl.cnf can fix it.

[system_default_sect]
MinProtocol = TLSv1.0
CipherString = DEFAULT@SECLEVEL=2

[cnblogs-dudu]

Now we use the following workaround in Dockerfile.

RUN sed -i 's/TLSv1.2/TLSv1.0/g' /etc/ssl/openssl.cnf

[MichaelSimons]

Per the guidance in the TLS 1.2 support at Microsoft blog, Microsoft is recommending the removal of TLS 1.0 and 1.1 dependencies. Support for TLS 1.2 was added in SQL Server 2008 R2 SP3 (see TLS 1.2 support for Microsoft SQL Server for details).

Closing as won't fix.

[weirdyang]

Where do I include that command?