与服务器建立连接成功，但随后在登录前握手 TCP Provider 时出错，错误：35

如何解决与服务器建立连接成功，但随后在登录前握手 TCP Provider 时出错，错误：35

您需要更新 sql Server 计算机以使用 TLS 1.2。Windows 和 sql Server 都必须更新，否则将无法工作。

对于 Windows 本身，您使用的是 Windows Server 2008 R2，它至少需要此更新，实际上您应该更新到最新版本。
对于 sql Server，您至少需要获取此更新。在执行此操作之前，您还必须进行SP4 更新。

您拥有的两个版本都严重过时，并且没有收到最新的安全修复程序，其中一些非常严重。

解决方法

我正在尝试从 Xubuntu 22.04 和 .NET 6.0 连接到 SQL Server 2008 R2（Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (X64)）：

var sqlConnection = new SqlConnection("Server=server;Database=MyDb;User Id=MyUser;Password=MyPassword;ENCRYPT=false;TrustServerCertificate=true");

尝试使用连接时出现此错误：

 System.Data.SqlClient.SqlException : A connection was successfully established with the server,but then an error occurred during the pre-login handshake. (provider: TCP Provider,error: 35 - An internal exception was caught)
---- System.Security.Authentication.AuthenticationException : Authentication failed,see inner exception.
-------- Interop+OpenSsl+SslException : SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL.
------------ Interop+Crypto+OpenSslCryptographicException : error:0A000102:SSL routines::unsupported protocol

从我已经尝试过的连接字符串中可以看出Encrypt=false，TrustServerCertificate=true.

我还尝试了解决方案：

sed -i 's/openssl_conf = openssl_init/#openssl_conf = openssl_init/g' /etc/ssl/openssl.cnf

我也试过这个：

MinProtocol=TLSv1 CipherString=DEFAULT@SECLEVEL=1 dotnet run

更新：

它无需从 Windows 客户端进行修改即可工作。

更新：

我/etc/ssl/openssl.cnf从这个改变：

[system_default_sect]
CipherString = DEFAULT:@SECLEVEL=2

对此：

[system_default_sect]
MinProtocol = TLSv1.0
CipherString = DEFAULT@SECLEVEL=1

现在错误是：

System.Data.SqlClient.SqlException
A connection was successfully established with the server,but then an error occurred during the pre-login handshake. (provider: SSL Provider,error: 31 - Encryption(ssl/tls) handshake failed)

这个

[system_default_sect]
CipherString = DEFAULT@SECLEVEL=1

导致这个：

Interop+OpenSsl+SslException
SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL.
   at Interop.OpenSsl.DoSslHandshake(SafeSslHandle context,ReadOnlySpan`1 input,Byte[]& sendBuf,Int32& sendCount)
   at System.Net.Security.SslStreamPal.HandshakeInternal(SafeFreeCredentials credential,SafeDeleteSslContext& context,ReadOnlySpan`1 inputBuffer,Byte[]& outputBuffer,SslAuthenticationOptions sslAuthenticationOptions)

Interop+Crypto+OpenSslCryptographicException
error:0A0C0103:SSL routines::internal error
  Exception doesn't have a stacktrace

更新：

必须有一个可行的选项，因为我可以在同一台机器上使用带有 jTds 驱动程序的 DataGrip 连接到数据库。

更新：

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=1

结果：

Interop+OpenSsl+SslException
SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL.
   at Interop.OpenSsl.DoSslHandshake(SafeSslHandle context,SslAuthenticationOptions sslAuthenticationOptions)


Interop+Crypto+OpenSslCryptographicException
error:0A000102:SSL routines::unsupported protocol
  Exception doesn't have a stacktrace

**更新**（来自https://github.com/dotnet/SqlClient/issues/567）：

openssl s_client -tls1 -connect server:1433
CONNECTED(00000003)

更新：

对注册表进行了以下更改：

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols]



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]

"DisabledByDefault"=dword:00000001

"Enabled"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]

"Enabled"=dword:00000000

"DisabledByDefault"=dword:00000001



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]

"Enabled"=dword:ffffffff

"DisabledByDefault"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]

"Enabled"=dword:ffffffff

"DisabledByDefault"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1]



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]

"Enabled"=dword:ffffffff

"DisabledByDefault"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]

"Enabled"=dword:ffffffff

"DisabledByDefault"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]

"Enabled"=dword:ffffffff

"DisabledByDefault"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]

"Enabled"=dword:ffffffff

"DisabledByDefault"=dword:00000000

更新：

我还安装了这样的根 CA 证书：

sudo apt-get install -y ca-certificates
sudo cp local-ca.crt /usr/local/share/ca-certificates
sudo update-ca-certificates

更新：

更多openssl输出：

SSL_connect:before SSL initialization
>>> TLS 1.0,RecordHeader [length 0005]
    16 03 01 00 74
>>> TLS 1.1,Handshake [length 0074],ClientHello
write to 0x55971383cef0 [0x55971384e1b0] (121 bytes => 121 (0x79))
SSL_connect:SSLv3/TLS write client hello
read from 0x55971383cef0 [0x559713844f93] (5 bytes => -1)
SSL_connect:error in SSLv3/TLS write client hello
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 121 bytes
Verification: OK
---
New,(NONE),Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1658171132
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---
read from 0x55971383cef0 [0x559713798600] (8192 bytes => 0)