This might be different for each client, so you need to test them separately.įirst of all for most clients (since they use SChannel) your Windows machines need to be recent enough to support TLSv1.2 (I.e. I have determined that at least a couple of our older SQL servers are Windows 2012 (not R2), which (I believe) does not have TLS 1.2 enabled by default, where it should be for Windows 2012 R2 and later? Is that right?Īlso still interested if anyone has a query and/or other method to determine what protocols different clients are using when they attempt their first connection to SQL or would that be a network-layer tool?

I know we will eventually need to look at individual applications, but I can't help but think there is something more obvious going on here.Īlso, is there a SQL query that can tell me what connection method was attempted by each application (none vs TLS 1.0 vs TLS 1.2)? This page suggests encrypt_option from sys.dm_exec_connections, but that appears to be a boolean, not one that tells me the type (plus all my rows show FALSE, so I don't think that's right). what am I missing? Is there a master switch at the Windows OS level on our application servers that was never flipped to tell applications they should start using TLS 1.2? (We run Windows 2012 R.) Are there different registry entries for enabling 'client' TLS 1.2 vs enabling 'server' TLS 1.2? I thought that clients already tried to negotiate the most secure encryption protocol that both the app and SQL support (TLS 1.2), but that's clearly not the case here. This question is a bit more broad.)Īll our SQL servers (SQL 2012-2017) are on recent patch levels that support TLS 1.2 (see first link above), and yet when we disabled TLS 1.0 on our SQL servers, nearly all our applications broke (SharePoint farms, web apps, dot.net apps, PowerShell scripts, many vendor apps, heck, even some SQL jobs running on the same box failed). (I don't believe this is a duplicate of any other TLS-related question, like the authoritative question about SQL Compatibility with TLS or its many duplicates, or questions about specific TLS-related issues you might encounter with SQL CLRs or Classic ASP or SSRS or whatever.

Test tls 1.2 server 2008