Msphpsql: [Microsoft][ODBC Driver 17 for SQL Server]SSL Provider: [error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol]

[Razorhunter]

I had upgrade my Ubuntu 19.10 to 20.04 Beta and caught this exception when trying to connect to MSSQL server. Previously it worked in Ubuntu 19.10.

SQL Server : 12.0.4100.1
PHP : 7.1.33
OS: Ubuntu 20.04 Beta

Anybody can help me, I'm really appreciate it. Thank You

[yitam]

Just so you know, @Razorhunter , we do not officially support Ubuntu 20.04 yet.

That being said, have you tried connecting to another SQL Server instance? Say SQL Server 2017 or later? I suspect it might be related to #1021

[Razorhunter]

@yitam For the time being, we only got production SQL Server 2014 and we didn't plan to upgrade to the newest version. There are no other workaround for it for the time being?

[yitam]

hi @Razorhunter please check the comments in #1021 and #1023 for various options or workarounds

[yitam]

FYI, @Razorhunter

I just did a brief test. I have no problem connecting to SQL Server 2017 or above from Ubuntu 20.04.

For further explanation, please check our reply to a similar issue.

But if upgrading your server is not an option for you now, this suggestion for Debian might help you.

Save a backup /etc/ssl/openssl.cnf first and then modify the file by following the steps below (disclaimer: doing this may compromise the security):

1. Add openssl_conf = default_conf near the top
2. Add the following at the end:

[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=1 

But if your SQL Server does not yet support TLSv1.2, it's highly recommended that you follow the instructions to update. Again, if you do not plan to upgrade yet, you may change the line MinProtocol = TLSv1.2 to TLSv1.0 (it's your choice but not recommended)

[yitam]

Any update, @Razorhunter ?

[Razorhunter]

@yitam Just want you to know, I did successfully connect to the MSSQL 2017 with Ubunt 20.04. Seems like you previous suggestion using MSSQL 2017 and above is a correct way for now. I had move my staging server to new VM and installed MSSQL2017 for now. The production server remains using MSSQL 2014. Tq for your help

[yitam]

You're welcome @Razorhunter
Closing this issue now, and please feel free to reopen if necessary

[ludufre]

I have this problem with an outdated SQL Server connecting from Oracle Linux 8.2.

The location to change MinProtocol: /etc/crypto-policies/back-ends/opensslcnf.config

[esundberg]

This was helpful.

Ubuntu 20.04 PHP 7.4 using the 19.10 drivers for sqlsrv

We have a real old SQL server out there . The SQL Server show's version 10.50.2550.0, i think it's SQL Server 2008 R2. I had to use TLSv1 to connect to the server. I also had to do a "systemctl restart apache2" to get it to take affect. TLSv1.1 did not work with my MSSQL server version.

Error message: Connection failed: SQLSTATE[08001]: [Microsoft][ODBC Driver 17 for SQL Server]SSL Provider: [error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol]Database Connection Error

edit: /etc/ssl/openssl.cnf
1st line in the file added
openssl_conf = default_conf

End of file added

[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=1

Not 100% sure why i had to restart apache2 for it to take effect, but I had to.

systemctl restart apache2

reloaded the page and it works

[Razorhunter]

@esundberg thank you...i tried your solution and IT WORKS!!! ... thanks a lot...very appreciate it

[satarasov]

@esundberg thanks a lot, saved my day!

[githubjeka]

If you use docker:

1. Get https://github.com/openssl/openssl/blob/master/apps/openssl.cnf and save as openssl.cnf
2. Add to end file

[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=1

1. Add to Dockerfile the row
   ```
   COPY openssl.cnf /etc/ssl/openssl.cnf
   ````
   

2. Rebuild image and run container

[daveschafer]

If you use docker:

1. Get https://github.com/openssl/openssl/blob/master/apps/openssl.cnf and save as `openssl.cnf`

2. Add to end file

[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=1

1. Add to Dockerfile the row

COPY openssl.cnf /etc/ssl/openssl.cnf

1. Rebuild image and run container

This almost worked perfectly for my use case (docker on Ubuntu 2004 connecting to SQL Server 2014).
But I had to replace the Line 17 with this to get it working:

openssl_conf = openssl_init

openssl_conf = default_conf

[githubjeka]

To history, Line 17 is https://github.com/openssl/openssl/blob/e45d943665e806ff49d06cfbdd566a8e2d57d56d/apps/openssl.cnf#L17

[MaguiTai]

https://github.com/microsoft/msphpsql/issues/1112#issuecomment-643522139
.... MAGIK ....
thanks

[himalayantechies]

This was helpful.

Ubuntu 20.04 PHP 7.4 using the 19.10 drivers for sqlsrv

We have a real old SQL server out there . The SQL Server show's version 10.50.2550.0, i think it's SQL Server 2008 R2. I had to use TLSv1 to connect to the server. I also had to do a "systemctl restart apache2" to get it to take affect. TLSv1.1 did not work with my MSSQL server version.

Error message: Connection failed: SQLSTATE[08001]: [Microsoft][ODBC Driver 17 for SQL Server]SSL Provider: [error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol]Database Connection Error

edit: /etc/ssl/openssl.cnf
1st line in the file added
openssl_conf = default_conf

End of file added

[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=1

Not 100% sure why i had to restart apache2 for it to take effect, but I had to.

systemctl restart apache2

reloaded the page and it works

Hi,
I did that , but still I am getting the same error.
Server : Ubuntu 20.04.1 LTS
SQL Server: Microsoft SQL Server 2008 (RTM) - 10.0.1600.22 (X64)
Changed openssl.cnf
Apache2 restarted
Didnt work,
Changed MinProtocol = TLSv1.2 to TLSv1.0
Didnt work

[himalayantechies]

FYI, @Razorhunter

I just did a brief test. I have no problem connecting to SQL Server 2017 or above from Ubuntu 20.04.

For further explanation, please check our reply to a similar issue.

But if upgrading your server is not an option for you now, this suggestion for Debian might help you.

Save a backup /etc/ssl/openssl.cnf first and then modify the file by following the steps below (disclaimer: doing this may compromise the security):

1. Add `openssl_conf = default_conf` near the top

2. Add the following at the end:

[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=1 

But if your SQL Server does not yet support TLSv1.2, it's highly recommended that you follow the instructions to update. Again, if you do not plan to upgrade yet, you may change the line MinProtocol = TLSv1.2 to TLSv1.0 (it's your choice but not recommended)

Hi,
I did that , but still I am getting the same error.
Server : Ubuntu 20.04.1 LTS
SQL Server: Microsoft SQL Server 2008 (RTM) - 10.0.1600.22 (X64)
Changed openssl.cnf
Apache2 restarted
Didnt work,
Changed MinProtocol = TLSv1.2 to TLSv1.0
Didnt work

[yitam]

Hi @himalayantechies

Note that we no longer support SQL Server 2008 or 2008 R2. Please consider upgrading your server or using an older Ubuntu version, such as 18.04 LTS.

[himalayantechies]

Hi @himalayantechies

Note that we no longer support SQL Server 2008 or 2008 R2. Please consider upgrading your server or using an older Ubuntu version, such as 18.04 LTS.

Thanks

[linuxkathirvel]

MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=1

This was helpful.

Ubuntu 20.04 PHP 7.4 using the 19.10 drivers for sqlsrv

We have a real old SQL server out there . The SQL Server show's version 10.50.2550.0, i think it's SQL Server 2008 R2. I had to use TLSv1 to connect to the server. I also had to do a "systemctl restart apache2" to get it to take affect. TLSv1.1 did not work with my MSSQL server version.

Error message: Connection failed: SQLSTATE[08001]: [Microsoft][ODBC Driver 17 for SQL Server]SSL Provider: [error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol]Database Connection Error

edit: /etc/ssl/openssl.cnf
1st line in the file added
openssl_conf = default_conf

End of file added

[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=1

Not 100% sure why i had to restart apache2 for it to take effect, but I had to.

systemctl restart apache2

reloaded the page and it works

This solution is working fine for me on Debian 10.

[linuxkathirvel]

This was helpful.

Ubuntu 20.04 PHP 7.4 using the 19.10 drivers for sqlsrv

We have a real old SQL server out there . The SQL Server show's version 10.50.2550.0, i think it's SQL Server 2008 R2. I had to use TLSv1 to connect to the server. I also had to do a "systemctl restart apache2" to get it to take affect. TLSv1.1 did not work with my MSSQL server version.

Error message: Connection failed: SQLSTATE[08001]: [Microsoft][ODBC Driver 17 for SQL Server]SSL Provider: [error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol]Database Connection Error

edit: /etc/ssl/openssl.cnf
1st line in the file added
openssl_conf = default_conf

End of file added

[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=1

Not 100% sure why i had to restart apache2 for it to take effect, but I had to.

systemctl restart apache2

reloaded the page and it works

Thanks @esundberg